CVE-2006-6585
Last modified
CVE-2006-6585 is a vulnerability of currently unknown severity. The Extensions manager in Mozilla Firefox 2.0 does not properly populate the list of local extensions, which allows attackers to construct an extension that hides itself by finding its name in the list and then calling RemoveElement, as demonstrated by the FFsniFF extension. NOTE: it was later reported that 3.0 is also affected.. EPSS estimates a 0.99% chance of exploitation in the next 30 days.
Description
The Extensions manager in Mozilla Firefox 2.0 does not properly populate the list of local extensions, which allows attackers to construct an extension that hides itself by finding its name in the list and then calling RemoveElement, as demonstrated by the FFsniFF extension. NOTE: it was later reported that 3.0 is also affected.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 2.0 |
| Mozilla | Firefox | 3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-6585?
How severe is CVE-2006-6585?
How do I fix CVE-2006-6585?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-6579Microsoft Windows XP has weak permissions (FILE_WRITE_DATA a…
- CVE-2006-6580admin/change.php in ProNews 1.5 does not check whether a use…
- CVE-2006-6581PHP remote file inclusion vulnerability in tests/debug_test.…
- CVE-2006-6582Multiple cross-site scripting (XSS) vulnerabilities in Scrip…
- CVE-2006-6583ScriptMate User Manager 2.1 and earlier allow remote attacke…
- CVE-2006-6584Multiple buffer overflows in italkplus (Italk+) before 0.92.…
- CVE-2006-6586Multiple PHP remote file inclusion vulnerabilities in Vortex…
- CVE-2006-6587Cross-site scripting (XSS) vulnerability in the forum implem…
- CVE-2006-6588The forum implementation in the ecommerce component in the A…
- CVE-2006-6589Cross-site scripting (XSS) vulnerability in ecommerce/contro…
- CVE-2006-6590PHP remote file inclusion vulnerability in usercp_menu.php i…
- CVE-2006-6591PHP remote file inclusion vulnerability in fonctions/templat…
Are you affected by CVE-2006-6585?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST