Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339. NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462.
Metrics
Affected Vendors & Products
Advisories
Source | ID | Title |
---|---|---|
![]() |
DSA-1191-1 | New Mozilla Thunderbird packages fix several vulnerabilities |
![]() |
DSA-1192-1 | New Mozilla packages fix several vulnerabilities |
![]() |
DSA-1210-1 | New Mozilla Firefox packages fix several vulnerabilities |
![]() |
EUVD-2006-4328 | Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339. NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462. |
![]() |
USN-350-1 | Thunderbird vulnerabilities |
![]() |
USN-351-1 | firefox vulnerabilities |
![]() |
USN-352-1 | Thunderbird vulnerabilities |
![]() |
USN-361-1 | Mozilla vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.

Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-07T19:06:07.315Z
Reserved: 2006-08-24T00:00:00
Link: CVE-2006-4340

No data.

Status : Deferred
Published: 2006-09-15T18:07:00.000
Modified: 2025-04-03T01:03:51.193
Link: CVE-2006-4340


No data.