CVE-2011-3658 The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of ser...
HighCVSS 7.5
EPSS 70.3%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | = 8.0 | No fix listed |
| mozilla seamonkey | = 2.5 | No fix listed |
| mozilla Thunderbird | = 8.0 | No fix listed |
References
- openSUSE-SU-2012:0007 vendor-advisory
- openSUSE-SU-2012:0039 vendor-advisory
- openSUSE-SU-2012:0417 vendor-advisory
- 77953 vdb-entry
- 47302 third-party-advisory
- 47334 third-party-advisory
- 48495 third-party-advisory
- 48553 third-party-advisory
- 48823 third-party-advisory
- 49055 third-party-advisory
- MDVSA-2011:192 vendor-advisory
- MDVSA-2012:031 vendor-advisory
- www.mozilla.org vendor-advisory
- 1026445 vdb-entry
- 1026446 vdb-entry
- 1026447 vdb-entry
- USN-1401-1 vendor-advisory
- bugzilla.mozilla.org
- firefox-domattrmodified-code-exec(71910) vdb-entry
- oval:org.mitre.oval:def:14664 signature vdb-entry