CVE-2011-3659 Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbit...
HighCVSS 9.3
EPSS 36.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | < 3.6.26 | 3.6.26 |
| mozilla Firefox | >= 4.0, < 10.0 | 10.0 |
| mozilla seamonkey | < 2.7 | 2.7 |
| mozilla Thunderbird | < 3.1.18 | 3.1.18 |
| mozilla Thunderbird | >= 5.0, < 10.0 | 10.0 |
| opensuse | = 11.4 | No fix listed |
| SUSE linux enterprise desktop | = 10-sp4 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp1 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| SUSE linux enterprise software development kit | = 10-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp1 | No fix listed |
References
- SUSE-SU-2012:0198 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2012:0221 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2012:0234 mailing-list third-party-advisory vendor-advisory
- MDVSA-2012:013 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- bugzilla.mozilla.org exploit issue-tracking patch vendor-advisory
- oval:org.mitre.oval:def:14697 signature third-party-advisory vdb-entry