CVE-2011-0073
At a glance
- Source
- NVD
- EPSS
- EPSS 70.89 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly use nsTreeRange data structures, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer."
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
- http://www.debian.org/security/2011/dsa-2228
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14020
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:079
- https://bugzilla.mozilla.org/show_bug.cgi?id=630919
- http://www.mozilla.org/security/announce/2011/mfsa2011-13.html
- http://www.debian.org/security/2011/dsa-2235
- http://downloads.avaya.com/css/P8/documents/100134543
- http://www.debian.org/security/2011/dsa-2227
- http://downloads.avaya.com/css/P8/documents/100144158
- http://securityreason.com/securityalert/8310
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2011-0099
- GCVE · GCVE-0-2011-0073
CERT-FR advisories
- CERTA-2011-AVI-267 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*≤ 2.0.13cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*- +124 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |