--- title: "CVE-2006-2786\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2006-2786?format=md keywords: index, follow --- # CVE-2006-2786 Publication date 2 June 2006 Last updated 17 July 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description HTTP response smuggling vulnerability in Mozilla Firefox and Thunderbird before 1.5.0.4, when used with certain proxy servers, allows remote attackers to cause Firefox to interpret certain responses as if they were responses from two different sites via (1) invalid HTTP response headers with spaces between the header name and the colon, which might not be ignored in some cases, or (2) HTTP 1.1 headers through an HTTP 1.0 proxy, which are ignored by the proxy but processed by the client. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | firefox | 7.04 feisty | Not affected | | 6.10 edgy | Not affected | | 6.06 LTS dapper | Fixed 1.5.dfsg+1.5.0.13~prepatch070731-0ubuntu1 | | firefox-granparadiso | 7.04 feisty | Not in release | | 6.10 edgy | Not in release | | 6.06 LTS dapper | Not in release | | lightning-sunbird | 7.04 feisty | Not in release | | 6.10 edgy | Not in release | | 6.06 LTS dapper | Not in release | | midbrowser | 7.04 feisty | Not in release | | 6.10 edgy | Not in release | | 6.06 LTS dapper | Not in release | | mozilla-thunderbird | 7.04 feisty | Fixed 1.5.0.13-0ubuntu0.7.04 | | 6.10 edgy | Fixed 1.5.0.13-0ubuntu0.6.10 | | 6.06 LTS dapper | Fixed 1.5.0.13-0ubuntu0.6.06 | | xulrunner | 7.04 feisty | Fixed 1.8.0.5-4.2 | | 6.10 edgy | Fixed 1.8.0.5-4.2 | | 6.06 LTS dapper | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2786) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2006-2786) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2006-2786) * [Debian](https://security-tracker.debian.org/tracker/CVE-2006-2786) ### Related Ubuntu Security Notices (USN) + [USN-323-1](https://usn.ubuntu.com/USN-323-1) + mozilla vulnerabilities + 26 July 2006 + [USN-297-1](https://usn.ubuntu.com/USN-297-1) + Thunderbird vulnerabilities + 14 June 2006 + [USN-296-2](https://usn.ubuntu.com/USN-296-2) + Firefox vulnerabilities + 25 July 2006 + [USN-296-1](https://usn.ubuntu.com/USN-296-1) + firefox vulnerabilities + 9 June 2006 ### Other references *