CVE-2011-2605
published 2011-06-30CVE-2011-2605: CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18…
PriorityP417medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.03%
60.4th percentile
CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374.
Affected
190 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 3.6.17 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)
vendor_redhat·2011-06-21·CVSS 10.0
CVE-2011-2605 [CRITICAL] Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)
Mozilla Miscellaneous memory safety hazards (MFSA 2011-19)
CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374.
GHSA
GHSA-m4ch-8pc5-rpx2: CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2011-2605 [CRITICAL] CWE-94 GHSA-m4ch-8pc5-rpx2: CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService
CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374.
No detection rules found.
No public exploits indexed.
http://www.mozilla.org/security/announce/2011/mfsa2011-19.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0885.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0886.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0887.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0888.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=643051https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14401http://www.mozilla.org/security/announce/2011/mfsa2011-19.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0885.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0886.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0887.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0888.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=643051https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14401
2011-06-30
Published