CVE-2006-4567: Mozilla Firefox

Low severity, CVSS 2.6. EPSS: 1.9% chance of exploitation in the next 30 days.

Mozilla Firefox before 1.5.0.7 and Thunderbird before 1.5.0.7 makes it easy for users to accept self-signed certificates for the auto-update mechanism, which might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site, which can then be used to install arbitrary code on the next update.

Affected products

• Mozilla Firefox: up to and including 1.5.0.6
• Mozilla Thunderbird: up to and including 1.5.0.6

Published 2006-09-15. Last modified 2026-06-16.