CVE-2011-0056
Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving exception timing and a large number of string…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving exception timing and a large number of string values, aka an "atom map" issue.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 4.55% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- mozilla/firefox · mozilla/seamonkey
- Source
- cve@mitre.org
References
- http://downloads.avaya.com/css/P8/documents/100133195
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
- http://www.mozilla.org/security/announce/2011/mfsa2011-05.htmlVendor Advisory
- http://www.securityfocus.com/bid/46650
- https://bugzilla.mozilla.org/show_bug.cgi?id=622015
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14013
- http://downloads.avaya.com/css/P8/documents/100133195
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:041
- http://www.mozilla.org/security/announce/2011/mfsa2011-05.htmlVendor Advisory
- http://www.securityfocus.com/bid/46650
- https://bugzilla.mozilla.org/show_bug.cgi?id=622015
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14013
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.