CVE-2006-2786 Other in n/a
Remote attackers can exploit HTTP response smuggling in Firefox via specific proxy configurations to bypass security boundaries and access data from different sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2006-2786?
CVE-2006-2786 is a low-severity vulnerability in Mozilla Firefox, published on 2 Jun 2006. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HTTP response smuggling vulnerability in Mozilla Firefox and Thunderbird before 1.5.0.4, when used with certain proxy servers, allows remote attackers to cause Firefox to interpret certain responses as if they were responses from two different sites via (1) invalid HTTP response headers with spaces between the header name and the colon, which might not be ignored in some cases, or (2) HTTP 1.1 headers through an HTTP 1.0 proxy, which are ignored by the proxy but processed by the client.
Which versions are affected by CVE-2006-2786?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2006-2786?
Upgrade to a fixed version.
Is CVE-2006-2786 being exploited?
There is no known exploitation of CVE-2006-2786 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2006-2786, GHSA-h93j-jrrw-xqfp.