CVE catalog

CVE-2006-6077

firefox-esr-128.5.1-1.1 on GA media

Severity: Unknown
Published: Jul 22, 2007, 12:00:00 AM UTC
Updated: Mar 9, 2026, 1:00:50 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.14% · Oct 22, 2026

The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password, which allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	mozilla-firefox	3.1	`1.0.4-2`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge1`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge10`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge11`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge12`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge13`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge14`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge15`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge2`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge3`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge4`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge5`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge6`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge7`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge9`	vulnerable
Debian	mozilla-firefox	3.1	`1.0.4-2sarge17`	fixed
Opensuse	MozillaFirefox	tumbleweed	`92.0-1.2`	fixed
Opensuse	firefox-esr	tumbleweed	`128.5.1-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	mozilla-firefox	deb	3.1	`1.0.4-2sarge17`	Not reported	DSA-1336-1	Not reported
Opensuse	MozillaFirefox	rpm	tumbleweed	`92.0-1.2`	Not reported	OPENSUSE-SU-2024:10600-1	Not reported
Opensuse	firefox-esr	rpm	tumbleweed	`128.5.1-1.1`	Not reported	OPENSUSE-SU-2024:14572-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[openSUSE Tumbleweed]

[firefox-esr]Unknown
Source package: [firefox-esr]
Details (1)
- 153.1.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 128.5.1-1.1
  pypi · firefox-esr · opensuse · tumbleweed
[firefox-esr-branding-upstream]Unknown
Source package: [firefox-esr]
Details (1)
- 153.1.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.5.1-1.1
  Version impact unknown
  pypi · firefox-esr · opensuse · tumbleweed
[firefox-esr-translations-common]Unknown
Source package: [firefox-esr]
Details (1)
- 153.1.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.5.1-1.1
  Version impact unknown
  pypi · firefox-esr · opensuse · tumbleweed
[firefox-esr-translations-other]Unknown
Source package: [firefox-esr]
Details (1)
- 153.1.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.5.1-1.1
  Version impact unknown
  pypi · firefox-esr · opensuse · tumbleweed
[MozillaFirefox]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 92.0-1.2
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaFirefox-branding-upstream]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 92.0-1.2
  Version impact unknown
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaFirefox-devel]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 92.0-1.2
  Version impact unknown
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaFirefox-translations-common]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 92.0-1.2
  Version impact unknown
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaFirefox-translations-other]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 92.0-1.2
  Version impact unknown
  pypi · MozillaFirefox · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:03:21 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]