Vulnerability Description
Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code via a crafted XUL document.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Seamonkey | 1.0 |
| Mozilla | Firefox | <= 3.6.17 |
| Mozilla | Thunderbird | <= 3.1.10 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
- http://secunia.com/advisories/45002
- http://support.avaya.com/css/P8/documents/100144854
- http://support.avaya.com/css/P8/documents/100145333
- http://www.debian.org/security/2011/dsa-2268
- http://www.debian.org/security/2011/dsa-2269
- http://www.debian.org/security/2011/dsa-2273
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:111
- http://www.mozilla.org/security/announce/2011/mfsa2011-20.htmlVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2011-0885.html
- http://www.redhat.com/support/errata/RHSA-2011-0887.html
- http://www.redhat.com/support/errata/RHSA-2011-0888.html
- http://www.ubuntu.com/usn/USN-1149-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=617247
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68133
FAQ
What is CVE-2011-2373?
CVE-2011-2373 is a vulnerability with a CVSS score of 7.6 (HIGH). Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to ex...
How severe is CVE-2011-2373?
CVE-2011-2373 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-2373?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Seamonkey, Mozilla Firefox, Mozilla Thunderbird.