1. CVE-Search
  2. CVE-2011-3658
ID CVE-2011-3658
Summary The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:2.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:8.0:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 29-12-2017 - 02:29)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
accepted 2014-10-06T04:01:37.180-04:00
class vulnerability
contributors
  • name Scott Quint
    organization DTCC
  • name Sergey Artykhov
    organization ALTX-SOFT
  • name Sergey Artykhov
    organization ALTX-SOFT
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Shane Shaffer
    organization G2, Inc.
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Richard Helbing
    organization baramundi software
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
definition_extensions
  • comment Mozilla Firefox Mainline release is installed
    oval oval:org.mitre.oval:def:22259
  • comment Mozilla Thunderbird Mainline release is installed
    oval oval:org.mitre.oval:def:22093
  • comment Mozilla Seamonkey is installed
    oval oval:org.mitre.oval:def:6372
description The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.
family windows
id oval:org.mitre.oval:def:14664
status accepted
submitted 2011-12-30T14:35:52.000-05:00
title The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.
version 36
refmap via4
confirm
mandriva
  • MDVSA-2011:192
  • MDVSA-2012:031
osvdb 77953
sectrack
  • 1026445
  • 1026446
  • 1026447
secunia
  • 47302
  • 47334
  • 48495
  • 48553
  • 48823
  • 49055
suse
  • openSUSE-SU-2012:0007
  • openSUSE-SU-2012:0039
  • openSUSE-SU-2012:0417
ubuntu USN-1401-1
xf firefox-domattrmodified-code-exec(71910)
saint via4
bid 51138
description Firefox DOMAttrModified nsSVGValue Observer Handling Out-of-bounds Memory Access
id web_client_firefox
osvdb 77953
title firefox_domattrmodified_nssvgvalue
type client
Last major update 29-12-2017 - 02:29
Published 21-12-2011 - 04:02
Last modified 29-12-2017 - 02:29
Back to Top