CVE-2006-5462

NameCVE-2006-5462
DescriptionMozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1224-1, DSA-1225-1, DSA-1227-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firefox (PTS)sid48.0-1fixed
firefox-esr (PTS)wheezy (security)45.3.0esr-1~deb7u1fixed
jessie (security)45.3.0esr-1~deb8u1fixed
stretch, sid45.3.0esr-1fixed
icedove (PTS)wheezy38.7.0-1~deb7u1fixed
wheezy (security)1:45.2.0-2~deb7u1fixed
jessie38.8.0-1~deb8u1fixed
jessie (security)1:45.2.0-1~deb8u1fixed
stretch, sid1:45.2.0-4fixed
iceweasel (PTS)wheezy (security), wheezy38.8.0esr-1~deb7u1fixed
jessie (security), jessie38.8.0esr-1~deb8u1fixed
xulrunner (PTS)wheezy (security), wheezy24.8.1esr-2~deb7u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firefoxsource(unstable)45.0-1high
firefox-esrsource(unstable)45.0esr-1high
icedovesource(unstable)1.5.0.8-1medium
iceweaselsource(unstable)2.0+dfsg-1high
mozillasource(unstable)(unfixed)high
mozillasourcesarge2:1.7.8-1sarge8mediumDSA-1224-1
mozilla-firefoxsourcesarge1.0.4-2sarge13mediumDSA-1225-1
mozilla-thunderbirdsourcesarge1.0.2-2.sarge1.0.8d.1mediumDSA-1227-1
xulrunnersource(unstable)1.8.0.8-1high

Notes

MFSA-2006-66
this is the similar to CVE-2006-4339, see also CVE-2006-4340
the fixes for CVE-2006-4340 were incomplete

Search for package or bug name: Reporting problems