CVE-2006-2778: Mozilla Firefox

Medium severity, CVSS 5.0. EPSS: 4.9% chance of exploitation in the next 30 days.

The crypto.signText function in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to execute arbitrary code via certain optional Certificate Authority name arguments, which causes an invalid array index and triggers a buffer overflow.

Affected products

• Mozilla Firefox: up to and including 1.5.0.3
• Mozilla Thunderbird: up to and including 1.5.0.3

Published 2006-06-02. Last modified 2026-06-16.