CVE-2011-3659
Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 36.6%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 36.65% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise server · suse/linux enterprise software development kit
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.htmlMailing List, Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:013Third Party Advisory
- http://www.mozilla.org/security/announce/2012/mfsa2012-04.htmlVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=708198Exploit, Issue Tracking, Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14697Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.htmlMailing List, Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:013Third Party Advisory
- http://www.mozilla.org/security/announce/2012/mfsa2012-04.htmlVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=708198Exploit, Issue Tracking, Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14697Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.