CVE-2006-3811

Name	CVE-2006-3811
Description	Multiple vulnerabilities in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Javascript that leads to memory corruption, including (1) nsListControlFrame::FireMenuItemActiveEvent, (2) buffer overflows in the string class in out-of-memory conditions, (3) table row and column groups, (4) "anonymous box selectors outside of UA stylesheets," (5) stale references to "removed nodes," and (6) running the crypto.generateCRMFRequest callback on deleted context.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1159, DSA-1160, DSA-1161

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	132.0.2-1	fixed
thunderbird (PTS)	bullseye	1:115.12.0-1~deb11u1	fixed
	bullseye (security)	1:128.4.3esr-1~deb11u1	fixed
	bookworm	1:115.16.0esr-1~deb12u1	fixed
	bookworm (security)	1:128.4.3esr-1~deb12u1	fixed
	sid, trixie	1:128.4.3esr-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
firefox	source	(unstable)	1.5.dfsg+1.5.0.5-1	high
mozilla	source	sarge	2:1.7.8-1sarge7.2.2		DSA-1160
mozilla	source	(unstable)	(unfixed)	high
mozilla-firefox	source	sarge	1.0.4-2sarge11		DSA-1161
mozilla-firefox	source	(unstable)	(unfixed)	high
mozilla-thunderbird	source	sarge	1.0.2-2.sarge1.0.8b.1		DSA-1159
mozilla-thunderbird	source	(unstable)	(unfixed)	medium
thunderbird	source	(unstable)	1.5.0.5-1	medium
xulrunner	source	(unstable)	1.8.0.5-1	high

MFSA-2006-55