Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Firefox 2.0 can be tricked into phishing pages

CVE-2006-6971 · published 19 years ago
Summary

Firefox version 2.0 may let attackers disguise malicious web addresses in unusual numeric formats, bypassing its built‑in phishing protection. This means users could be directed to fake sites that look legitimate. Updating to a newer browser version or applying the vendor’s patch eliminates the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox 2.0.0.1
cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
Original advisory text
Mozilla Firefox 2.0, possibly only when running on Windows, allows remote attackers to bypass the Phishing Protection mechanism by representing an IP address in (1) dotted-hex, (2) dotted-octal, (3...
Mozilla Firefox 2.0, possibly only when running on Windows, allows remote attackers to bypass the Phishing Protection mechanism by representing an IP address in (1) dotted-hex, (2) dotted-octal, (3) single decimal integer, (4) single hex integer, or (5) single octal integer format, which is not captured by the blacklist filter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published7 Feb 2007
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-6971 · NVD
Track software like this
Free during beta