Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339. NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462.
Conclusion & alert: CVE-2006-4340 is rated Moderate Risk (43.3/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.15%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 2.70% | 2.15% | -0.55% |
| 2 | 2026-04-12 | 3.09% | 2.70% | -0.39% |
| 3 | 2026-04-04 | — | 3.09% | — |
Full EPSS history (24 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 4.0 | 2.0 | MEDIUM |
|
4.9 | 4.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
high | CVE-2006-4340 high priority: Debian including 2 source packages (firefox, thunderbird), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6. | https://security-tracker.debian.org/tracker/CVE-2006-4340 |
gentoo
|
normal | CVE-2006-4340: 3 GLSA(s) (200609-19, 200610-01, 200610-06), 5 atom(s) (dev-libs/nss, mail-client/mozilla-thunderbird, mail-client/mozilla-thunderbird-bin, www-client/mozilla-firefox, www-client/mozilla-firefox-bin); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2006-4340 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2006-4340 |
ubuntu
|
medium | CVE-2006-4340 medium priority: Ubuntu including 6 source packages (firefox, firefox-granparadiso, lightning-sunbird, midbrowser, mozilla-thunderbird, xulrunner), 24 status rows across 4 suites (dapper, edgy, feisty, upstream): DNE 10, needs-triage 6, released 5, not-affected 2, ignored 1. | https://ubuntu.com/security/CVE-2006-4340 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| mozilla | firefox | <= 1.5.0.6 | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | network_security_services | <= 3.11.2 | cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:* |
| mozilla | seamonkey | <= 1.0.4 | cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* |
| mozilla | thunderbird | <= 1.5.0.6 | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |