CVE-2006-4567

Name	CVE-2006-4567
Description	Mozilla Firefox before 1.5.0.7 and Thunderbird before 1.5.0.7 makes it easy for users to accept self-signed certificates for the auto-update mechanism, which might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site, which can then be used to install arbitrary code on the next update.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	134.0.2-2	fixed
thunderbird (PTS)	bullseye	1:115.12.0-1~deb11u1	fixed
	bullseye (security)	1:128.6.0esr-1~deb11u1	fixed
	bookworm	1:128.5.0esr-1~deb12u1	fixed
	bookworm (security)	1:128.6.0esr-1~deb12u1	fixed
	sid, trixie	1:128.6.0esr-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
firefox	source	(unstable)	1.5.dfsg+1.5.0.7-1	unimportant
mozilla-firefox	source	sarge	(unfixed)	unimportant
mozilla-thunderbird	source	sarge	(unfixed)	unimportant
thunderbird	source	(unstable)	1.5.0.7-1	unimportant

MFSA-2006-58
The internal update mechanism is disabled in Debian