CVE-2006-1942: K-Meleon Project K-Meleon

Medium severity, CVSS 5.1. EPSS: 2.6% chance of exploitation in the next 30 days.

Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an "alternate web page."

Affected products

• K-Meleon Project K-Meleon: version 0.9.13 only
• Mozilla Firefox: version 1.5.0.2 only
• Netscape Navigator: version 7.2 only; version 8.0.40 only; version 8.1 only

Published 2006-04-20. Last modified 2026-06-16.