UnratedFix available
thunderbird — security advisory
Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow.
- Products
- thunderbird
- Affected versions
- Not specified
- Fixed versions
- 1.5.0.2-1
- CVEs
- CVE-2006-1730
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:12 UTC · Revision 1
Source evidence
Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow.
osv:DEBIAN-CVE-2006-1730
thunderbird
Fixed versions: 1.5.0.2-1
thunderbird
Fixed versions: 1.5.0.2-1
thunderbird
Fixed versions: 1.5.0.2-1
Complete source record
{
"id": "a7691bc0c288314dedc51321c784fd9d22de28ef66fac87ec706d6f573359b1e",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-1730",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-1730",
"summary": "Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow.",
"evidence": "osv:DEBIAN-CVE-2006-1730",
"products": [
{
"name": {
"value": "thunderbird",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "thunderbird",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0.2-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-1730",
"aliases": [
"DEBIAN-CVE-2006-1730"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-1730.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-1730.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0.2-1"
}
]
}
],
"package": {
"name": "thunderbird",
"purl": "pkg:deb/debian/thunderbird?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-1730.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
}
],
"modified": "2026-10-22T23:47:23.321103735Z",
"provider": "osv",
"upstream": [
"CVE-2006-1730"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-1730"
]
},
"related_cves": [
{
"value": "CVE-2006-1730",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410397,
"published_at": "2006-04-14T10:02:00+00:00"
}