UnratedFix available
thunderbird — security advisory
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
- Products
- thunderbird
- Affected versions
- Not specified
- Fixed versions
- 1.5.0.2-1
- CVEs
- CVE-2006-0294
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:15 UTC · Revision 1
Source evidence
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
osv:DEBIAN-CVE-2006-0294
thunderbird
Fixed versions: 1.5.0.2-1
thunderbird
Fixed versions: 1.5.0.2-1
thunderbird
Fixed versions: 1.5.0.2-1
Complete source record
{
"id": "4d77b6a7f494f4797d095b239a4de2a95d625b15e2efddf6504dae13c7b610a7",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-0294",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-0294",
"summary": "Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.",
"evidence": "osv:DEBIAN-CVE-2006-0294",
"products": [
{
"name": {
"value": "thunderbird",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-0294",
"aliases": [
"DEBIAN-CVE-2006-0294"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0294.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0294.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0294.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-22T23:47:27.693458926Z",
"provider": "osv",
"upstream": [
"CVE-2006-0294"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-0294"
]
},
"related_cves": [
{
"value": "CVE-2006-0294",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410593,
"published_at": "2006-02-02T20:06:00+00:00"
}