« Volver al listado

CVE-2006-3731

Estado: ModificadaBaja (2.6)—

Mozilla Firefox 1.5.0.4 y anteriores permite a atacantes remotos con la complicidad del usuario provocar una denegación de servicio caída mediante una codificación multipart/form-data en un fichero subido por el usuario. NOTA: una tercera parte afirma que este asunto podría estar relacionado con la extensión LiveHTTPHeaders.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mozilla — Firefox

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-3731",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-07-21T14:03:00.000",
  "references": [
    {
      "url": "http://www.securityfocus.com/archive/1/440119/100/100/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/440506/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/440119/100/100/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/440506/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox 1.5.0.4 and earlier allows remote user-assisted attackers to cause a denial of service (crash) via a form with a multipart/form-data encoding and a user-uploaded file.  NOTE: a third party has claimed that this issue might be related to the LiveHTTPHeaders extension."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox 1.5.0.4 y anteriores permite a atacantes remotos con la complicidad del usuario provocar una denegación de servicio caída mediante una codificación multipart/form-data en un fichero subido por el usuario. NOTA: una tercera parte afirma que este asunto podría estar relacionado con la extensión LiveHTTPHeaders."
    }
  ],
  "lastModified": "2026-06-16T22:27:41.097",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABB88E86-6E83-4A59-9266-8B98AA91774D"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E19ED1CA-DEBD-4786-BA7B-C122C7D2E5B7"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66BE50FE-EA21-4633-A181-CD35196DF06E"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D6BF5B1-86D1-47FE-9D9C-735718F94874"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84D15CE0-69DF-4EFD-801E-96A4D6AABEDB"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEE203DE-6C0E-4FDE-9C3A-0E73430F17DA"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2F38886-C25A-4C6B-93E7-36461405BA99"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "We do not consider a user-assisted crash of a client application such as Firefox to be a security issue.",
      "lastModified": "2006-08-30T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}