Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-2723 — Improper Input Validation in Firefox

CWE-20 — Improper Input Validation11 documents5 sources
Severity
5.0MEDIUMNVD
NVD4.3
EPSS
8.1%
top 7.82%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
5
Debian FirefoxDebian Firefox-esrFlock+2 more
Timeline
PublishedJun 1
Latest updateMay 1

Description

Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags. NOTE: a followup post indicated that the initial report could not be verified.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages5 packages

▶debiandebian/firefox< firefox 45.0-1 (sid)
▶debiandebian/firefox-esr< firefox 45.0-1 (sid)
▶NVDflock/flock1.0.7
▶NVDopera/opera_browser67 versions+66

🔴Vulnerability Details

5
GHSA
GHSA-7j2m-9286-4vwj: Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large number of nes↗2022-05-01
▶
GHSA
GHSA-qvv8-667j-3cm4: Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee↗2022-05-01
▶
GHSA
GHSA-8f62-2qv6-4x72: Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee tags, a r↗2022-05-01
▶
GHSA
GHSA-wxx6-mfw2-34xf: Flock beta 1 0↗2022-05-01
▶
OSV
CVE-2006-2723: Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large number of nes↗2006-06-01
▶

💥Exploits & PoCs

1
Exploit-DB
Mozilla Firefox 1.5.0.4 - 'marquee' Denial of Service↗2006-06-02
▶

📋Vendor Advisories

1
Debian
CVE-2006-2723: firefox - Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial...↗2006
▶