{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/2517?format=json","vulnerability_id":"VCID-puyd-54pf-mkd5","summary":"Paul Nickerson discovered that content-defined setters on an object prototype were\ngetting called by privileged UI code, and moz_bug_r_a4 was able to develop an\nexploit PoC that demonstrated that the higher privilege level could be passed\nalong to the content-defined attack code.Thunderbird shares the browser engine with Firefox\nand could be vulnerable if JavaScript were to be enabled in mail. This is not\nthe default setting and we strongly discourage users from running\nJavaScript in mail.","aliases":[{"alias":"CVE-2006-2776"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1100?format=json","purl":"pkg:mozilla/SeaMonkey@1.0.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:mozilla/SeaMonkey@1.0.2"}],"affected_packages":[],"references":[{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776","reference_id":"CVE-2006-2776","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776"},{"reference_url":"https://www.mozilla.org/en-US/security/advisories/mfsa2006-37","reference_id":"mfsa2006-37","reference_type":"","scores":[{"value":"critical","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2006-37"}],"weaknesses":[],"exploits":[],"severity_range_score":"9.0 - 10.0","exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-puyd-54pf-mkd5"}