CVE-2011-3660
published 2011-12-21CVE-2011-3660: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow…
PriorityP337critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
4.43%
90.4th percentile
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors.
Affected
71 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | seamonkey | <= 2.5 | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2012-01-24·CVSS 7.5
CVE-2011-3658 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler,
David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia
Knous, and Rober Longson discovered several memory safety issues which
could possibly be exploited to crash Thunderbird or execute arbitrary code
as the user that invoked Thunderbird. (CVE-2011-3660)
Aki Helin discovered a crash in the YARR regular expression library that
could be triggered by javascript in web content. (CVE-2011-3661)
It was discovered that a flaw in the Mozilla SVG implementation could
result in an out-of-bounds memory access if SVG elements were removed
during a DOMAttrModified event handler. An attacker could potentially
exploi
Ubuntu
Mozvoikko and ubufox update
vendor_ubuntu·2012-01-06·CVSS 7.5
[HIGH] Mozvoikko and ubufox update
Title: Mozvoikko and ubufox update
Summary: This update provides compatible packages for Firefox 9.
USN-1306-1 fixed vulnerabilities in Firefox. This update provides updated
Mozvoikko and ubufox packages for use with Firefox 9.
Original advisory details:
Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler,
David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia
Knous, and Rober Longson discovered several memory safety issues which
could possibly be exploited to crash Firefox or execute arbitrary code as
the user that invoked Firefox. (CVE-2011-3660)
Aki Helin discovered a crash in the YARR regular expression library that
could be triggered by javascript in web content. (CVE-2011-3661)
It was discovered that a flaw in the Mozilla SVG implementatio
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2012-01-06·CVSS 7.5
CVE-2011-3660 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Alexandre Poirot, Chris Blizzard, Kyle Huey, Scoobidiver, Christian Holler,
David Baron, Gary Kwong, Jim Blandy, Bob Clary, Jesse Ruderman, Marcia
Knous, and Rober Longson discovered several memory safety issues which
could possibly be exploited to crash Firefox or execute arbitrary code as
the user that invoked Firefox. (CVE-2011-3660)
Aki Helin discovered a crash in the YARR regular expression library that
could be triggered by javascript in web content. (CVE-2011-3661)
It was discovered that a flaw in the Mozilla SVG implementation could
result in an out-of-bounds memory access if SVG elements were removed
during a DOMAttrModified event handler. An attacker could potentially
exploit this vulnerabi
Red Hat
Mozilla: Multiple security flaws fixed in v3.6.25 (Mac) and v9
vendor_redhat·2011-12-20·CVSS 10.0
CVE-2011-3660 [CRITICAL] Mozilla: Multiple security flaws fixed in v3.6.25 (Mac) and v9
Mozilla: Multiple security flaws fixed in v3.6.25 (Mac) and v9
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors.
Statement: This issue did not affect the version of firefox and thunderbird packages as shipped with Red Hat Enterprise Linux 4, 5 and 6. This issue did not affect the version of seamonkey package as shipped with Red Hat Enterprise Linux 4.
GHSA
GHSA-8p2m-x8cq-f8cj: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4
ghsa_unreviewed·2022-05-17
CVE-2011-3660 [HIGH] GHSA-8p2m-x8cq-f8cj: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.htmlhttp://osvdb.org/77952http://secunia.com/advisories/47302http://secunia.com/advisories/47334http://secunia.com/advisories/49055http://www.mandriva.com/security/advisories?name=MDVSA-2011:192http://www.mozilla.org/security/announce/2011/mfsa2011-53.htmlhttp://www.securitytracker.com/id?1026445http://www.securitytracker.com/id?1026446http://www.securitytracker.com/id?1026447https://bugzilla.mozilla.org/show_bug.cgi?id=562442https://bugzilla.mozilla.org/show_bug.cgi?id=679494https://bugzilla.mozilla.org/show_bug.cgi?id=679986https://bugzilla.mozilla.org/show_bug.cgi?id=680687https://bugzilla.mozilla.org/show_bug.cgi?id=682252https://bugzilla.mozilla.org/show_bug.cgi?id=685186https://bugzilla.mozilla.org/show_bug.cgi?id=685321https://bugzilla.mozilla.org/show_bug.cgi?id=686107https://bugzilla.mozilla.org/show_bug.cgi?id=688364https://bugzilla.mozilla.org/show_bug.cgi?id=688974https://bugzilla.mozilla.org/show_bug.cgi?id=689892https://bugzilla.mozilla.org/show_bug.cgi?id=690376https://bugzilla.mozilla.org/show_bug.cgi?id=691746https://bugzilla.mozilla.org/show_bug.cgi?id=691873https://bugzilla.mozilla.org/show_bug.cgi?id=693143https://bugzilla.mozilla.org/show_bug.cgi?id=693144https://bugzilla.mozilla.org/show_bug.cgi?id=694200https://bugzilla.mozilla.org/show_bug.cgi?id=696579https://bugzilla.mozilla.org/show_bug.cgi?id=697255https://bugzilla.mozilla.org/show_bug.cgi?id=700512https://bugzilla.mozilla.org/show_bug.cgi?id=701248https://bugzilla.mozilla.org/show_bug.cgi?id=701637https://bugzilla.mozilla.org/show_bug.cgi?id=706249https://exchange.xforce.ibmcloud.com/vulnerabilities/71908https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14226http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.htmlhttp://osvdb.org/77952http://secunia.com/advisories/47302http://secunia.com/advisories/47334http://secunia.com/advisories/49055http://www.mandriva.com/security/advisories?name=MDVSA-2011:192http://www.mozilla.org/security/announce/2011/mfsa2011-53.htmlhttp://www.securitytracker.com/id?1026445http://www.securitytracker.com/id?1026446http://www.securitytracker.com/id?1026447https://bugzilla.mozilla.org/show_bug.cgi?id=562442https://bugzilla.mozilla.org/show_bug.cgi?id=679494https://bugzilla.mozilla.org/show_bug.cgi?id=679986https://bugzilla.mozilla.org/show_bug.cgi?id=680687https://bugzilla.mozilla.org/show_bug.cgi?id=682252https://bugzilla.mozilla.org/show_bug.cgi?id=685186https://bugzilla.mozilla.org/show_bug.cgi?id=685321https://bugzilla.mozilla.org/show_bug.cgi?id=686107https://bugzilla.mozilla.org/show_bug.cgi?id=688364https://bugzilla.mozilla.org/show_bug.cgi?id=688974https://bugzilla.mozilla.org/show_bug.cgi?id=689892https://bugzilla.mozilla.org/show_bug.cgi?id=690376https://bugzilla.mozilla.org/show_bug.cgi?id=691746https://bugzilla.mozilla.org/show_bug.cgi?id=691873https://bugzilla.mozilla.org/show_bug.cgi?id=693143https://bugzilla.mozilla.org/show_bug.cgi?id=693144https://bugzilla.mozilla.org/show_bug.cgi?id=694200https://bugzilla.mozilla.org/show_bug.cgi?id=696579https://bugzilla.mozilla.org/show_bug.cgi?id=697255https://bugzilla.mozilla.org/show_bug.cgi?id=700512https://bugzilla.mozilla.org/show_bug.cgi?id=701248https://bugzilla.mozilla.org/show_bug.cgi?id=701637https://bugzilla.mozilla.org/show_bug.cgi?id=706249https://exchange.xforce.ibmcloud.com/vulnerabilities/71908https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14226
2011-12-21
Published