CVE-2011-0054
Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving non-local JavaScript variables, aka an…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving non-local JavaScript variables, aka an "upvarMap" issue.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 4.55% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- mozilla/firefox · mozilla/seamonkey
- Source
- cve@mitre.org
References
- http://downloads.avaya.com/css/P8/documents/100133195
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
- http://www.mozilla.org/security/announce/2011/mfsa2011-04.htmlVendor Advisory
- http://www.securityfocus.com/bid/46648
- https://bugzilla.mozilla.org/show_bug.cgi?id=615657
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14018
- http://downloads.avaya.com/css/P8/documents/100133195
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
- http://www.mozilla.org/security/announce/2011/mfsa2011-04.htmlVendor Advisory
- http://www.securityfocus.com/bid/46648
- https://bugzilla.mozilla.org/show_bug.cgi?id=615657
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14018
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.