UnratedFix available
thunderbird — security advisory
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
- Products
- thunderbird
- Affected versions
- Not specified
- Fixed versions
- 1.5.0.2-1
- CVEs
- CVE-2006-0299
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:10 UTC · Revision 1
Source evidence
The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.
osv:DEBIAN-CVE-2006-0299
thunderbird
Fixed versions: 1.5.0.2-1
thunderbird
Fixed versions: 1.5.0.2-1
thunderbird
Fixed versions: 1.5.0.2-1
Complete source record
{
"id": "15f3adcbdb164c68b4fbcc96f8f82dba9f0dc06a27329c1ed7207bcba41f9479",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-0299",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-0299",
"summary": "The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal \"AnyName\" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions.",
"evidence": "osv:DEBIAN-CVE-2006-0299",
"products": [
{
"name": {
"value": "thunderbird",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-0299",
"aliases": [
"DEBIAN-CVE-2006-0299"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0299.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0299.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0299.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-22T23:47:21.034873046Z",
"provider": "osv",
"upstream": [
"CVE-2006-0299"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-0299"
]
},
"related_cves": [
{
"value": "CVE-2006-0299",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410294,
"published_at": "2006-02-02T23:06:00+00:00"
}