CVE-2011-3654
published 2011-11-09CVE-2011-3654: The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly handle links from SVG mpath elements to non-SVG elements, which…
PriorityP335critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
4.40%
90.3th percentile
The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly handle links from SVG mpath elements to non-SVG elements, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
Affected
234 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 7.0.1 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2011-11-28·CVSS 4.3
CVE-2011-3648 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Multiple vulnerabilities have been fixed in Thunderbird.
Yosuke Hasegawa discovered that the Mozilla browser engine mishandled
invalid sequences in the Shift-JIS encoding. It may be possible to trigger
this crash without the use of debugging APIs, which might allow malicious
websites to exploit this vulnerability. An attacker could possibly use this
flaw this to steal data or inject malicious scripts into web content.
(CVE-2011-3648)
Marc Schoenefeld discovered that using Firebug to profile a JavaScript file
with many functions would cause Firefox to crash. An attacker might be able
to exploit this without using the debugging APIs, which could potentially
remotely crash Thunderbird, resulting in a denial of service.
(CVE-2011-3650)
Jason Oren
Ubuntu
Mozvoikko and ubufox update
vendor_ubuntu·2011-11-23·CVSS 4.3
[MEDIUM] Mozvoikko and ubufox update
Title: Mozvoikko and ubufox update
Summary: This update provides packages compatible with Firefox 8.
USN-1277-1 fixed vulnerabilities in Firefox. This update provides updated
Mozvoikko and ubufox packages for use with Firefox 8.
Original advisory details:
Yosuke Hasegawa discovered that the Mozilla browser engine mishandled
invalid sequences in the Shift-JIS encoding. It may be possible to trigger
this crash without the use of debugging APIs, which might allow malicious
websites to exploit this vulnerability. An attacker could possibly use this
flaw this to steal data or inject malicious scripts into web content.
(CVE-2011-3648)
Marc Schoenefeld discovered that using Firebug to profile a JavaScript file
with many functions would cause Firefox to crash. An attacker might be able
to exp
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2011-11-23·CVSS 4.3
CVE-2011-3648 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Multiple vulnerabilities have been fixed in Firefox.
Yosuke Hasegawa discovered that the Mozilla browser engine mishandled
invalid sequences in the Shift-JIS encoding. It may be possible to trigger
this crash without the use of debugging APIs, which might allow malicious
websites to exploit this vulnerability. An attacker could possibly use this
flaw this to steal data or inject malicious scripts into web content.
(CVE-2011-3648)
Marc Schoenefeld discovered that using Firebug to profile a JavaScript file
with many functions would cause Firefox to crash. An attacker might be able
to exploit this without using the debugging APIs, which could potentially
remotely crash the browser, resulting in a denial of service.
(CVE-2011-3650)
Jason Orendorff, B
GHSA
GHSA-86j9-h2h5-2x9v: The browser engine in Mozilla Firefox before 8
ghsa_unreviewed·2022-05-17
CVE-2011-3654 [HIGH] CWE-119 GHSA-86j9-h2h5-2x9v: The browser engine in Mozilla Firefox before 8
The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly handle links from SVG mpath elements to non-SVG elements, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
Suricata
ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt
suricata·2011-07-15
CVE-2010-3654 ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt
ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt"; flow:established,to_client; flowbits:isset,ET.flash.pdf; file.data; content:"|07 07 02 17 07 06 1A 07 1B 1B 07 02 1C 07 07 1E|"; reference:bid,44504; reference:cve,2010-3654; classtype:attempted-user; sid:2013282; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_15, cve CVE_2010_3654, deployment Perimeter, confidence High, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Pu
http://secunia.com/advisories/49055http://www.mozilla.org/security/announce/2011/mfsa2011-48.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=694953https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13830http://secunia.com/advisories/49055http://www.mozilla.org/security/announce/2011/mfsa2011-48.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=694953https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13830
2011-11-09
Published