1. CVE-Search
  2. CVE-2011-2998
ID CVE-2011-2998
Summary Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.17:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.17:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.18:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.18:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.19:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.19:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.20:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.20:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.21:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.21:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.6.22:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.6.22:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 19-09-2017 - 01:33)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
oval via4
accepted 2014-10-06T04:00:59.956-04:00
class vulnerability
contributors
  • name Scott Quint
    organization DTCC
  • name Sergey Artykhov
    organization ALTX-SOFT
  • name Sergey Artykhov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
definition_extensions
comment Mozilla Firefox Mainline release is installed
oval oval:org.mitre.oval:def:22259
description Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.
family windows
id oval:org.mitre.oval:def:14012
status accepted
submitted 2011-11-25T18:26:14.000-05:00
title Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.
version 26
redhat via4
advisories
rhsa
id RHSA-2011:1341
rpms
  • firefox-0:3.6.23-1.el4
  • firefox-0:3.6.23-2.el5_7
  • firefox-0:3.6.23-2.el6_1
  • firefox-debuginfo-0:3.6.23-1.el4
  • firefox-debuginfo-0:3.6.23-2.el5_7
  • firefox-debuginfo-0:3.6.23-2.el6_1
  • xulrunner-0:1.9.2.23-1.el5_7
  • xulrunner-0:1.9.2.23-1.el6_1.1
  • xulrunner-debuginfo-0:1.9.2.23-1.el5_7
  • xulrunner-debuginfo-0:1.9.2.23-1.el6_1.1
  • xulrunner-devel-0:1.9.2.23-1.el5_7
  • xulrunner-devel-0:1.9.2.23-1.el6_1.1
  • thunderbird-0:3.1.15-1.el6_1
  • thunderbird-debuginfo-0:3.1.15-1.el6_1
  • thunderbird-0:1.5.0.12-44.el4
  • thunderbird-0:2.0.0.24-26.el5_7
  • thunderbird-debuginfo-0:1.5.0.12-44.el4
  • thunderbird-debuginfo-0:2.0.0.24-26.el5_7
  • seamonkey-0:1.0.9-76.el4
  • seamonkey-chat-0:1.0.9-76.el4
  • seamonkey-debuginfo-0:1.0.9-76.el4
  • seamonkey-devel-0:1.0.9-76.el4
  • seamonkey-dom-inspector-0:1.0.9-76.el4
  • seamonkey-js-debugger-0:1.0.9-76.el4
  • seamonkey-mail-0:1.0.9-76.el4
refmap via4
confirm
debian
  • DSA-2312
  • DSA-2313
  • DSA-2317
mandriva
  • MDVSA-2011:139
  • MDVSA-2011:140
  • MDVSA-2011:141
suse SUSE-SU-2011:1256
Last major update 19-09-2017 - 01:33
Published 30-09-2011 - 10:55
Last modified 19-09-2017 - 01:33
Back to Top