CVE-2006-1273 json
Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of scrip…
published 2006-03-19 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1277
- cvss
- 7.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of script action handlers such as onload and onmouseover, which triggers the crash when the user views the page source. NOTE: Red Hat has disputed this issue, suggesting that "It is likely the reporter was running the IE Tab extension," and Mozilla also confirmed that this is not an issue in Firefox itself
Exploit prediction
1.61% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C |
References
-
osvdb.org
/31833
vdb-entry
-
securityfocus.com
/archive/1/428159/100/0/threaded
mailing-list
-
securityreason.com
/securityalert/593
third-party-advisory
-
securityfocus.com
/archive/1/427977/100/0/threaded
mailing-list
Sources
- CVE List CVE-2006-1273
- NVD CVE-2006-1273
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.