CVE-2006-6500

CVE-2006-6500 is a medium-severity vulnerability in Mozilla Firefox with a CVSS 2.0 base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.

Key facts

• Severity: Medium (CVSS 2.0 base score 6.8)
• EPSS exploit prediction: 8% (94th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Mozilla Firefox
• Published: 2006-12-20
• Last modified: 2026-06-16

Description

Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by setting the CSS cursor to certain images that cause an incorrect size calculation when converting to a Windows bitmap.

Frequently asked questions

What is CVE-2006-6500?

Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by setting the CSS cursor to certain images that cause an incorrect size calculation when converting to a Windows bitmap.

How severe is CVE-2006-6500?

CVE-2006-6500 has a CVSS 2.0 base score of 6.8, rated medium severity.

Is CVE-2006-6500 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-6500?

CVE-2006-6500 primarily affects Mozilla Firefox. In total, 8 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2006-6500?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2006-6500 published?

CVE-2006-6500 was published on 2006-12-20 and last updated on 2026-06-16.

References

• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
• http://secunia.com/advisories/23282
• http://secunia.com/advisories/23420
• http://secunia.com/advisories/23422
• http://secunia.com/advisories/23545
• http://secunia.com/advisories/23598
• http://secunia.com/advisories/23614
• http://secunia.com/advisories/23672
• http://secunia.com/advisories/23692
• http://security.gentoo.org/glsa/glsa-200701-02.xml
• http://securitytracker.com/id?1017399
• http://securitytracker.com/id?1017400
• http://securitytracker.com/id?1017401
• http://www.gentoo.org/security/en/glsa/glsa-200701-03.xml
• http://www.gentoo.org/security/en/glsa/glsa-200701-04.xml
• http://www.kb.cert.org/vuls/id/722244
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:010
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:011
• http://www.mozilla.org/security/announce/2006/mfsa2006-69.html
• http://www.novell.com/linux/security/advisories/2006_80_mozilla.html
• http://www.novell.com/linux/security/advisories/2007_06_mozilla.html
• http://www.securityfocus.com/bid/21668
• http://www.us-cert.gov/cas/techalerts/TA06-354A.html
• http://www.vupen.com/english/advisories/2006/5068
• http://www.vupen.com/english/advisories/2008/0083

Affected products (8)

• cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
• cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
• cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:5.10:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*

More vulnerabilities in Mozilla Firefox

• CVE-2026-4725 — Critical (CVSS 10.0): Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149…
• CVE-2026-4692 — Critical (CVSS 10.0): Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR…
• CVE-2026-4689 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was…
• CVE-2026-4688 — Critical (CVSS 10.0): Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox…
• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…

All CVEs affecting Mozilla Firefox →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →