VULNERABILITY INTELLIGENCE

CVE-2006-6504

CVSS score9.3 HIGH
EPSS probability8.89%
CISA KEVNot currently listed
Published2006-12-20
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C

Description

Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references