Vulnerability Description
Buffer overflow in an unspecified string class in the WebGL shader implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long source-code block for a shader.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 4.0 |
| Mozilla | Seamonkey | 2.0 |
| Mozilla | Thunderbird | <= 5.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
- http://secunia.com/advisories/49055
- http://www.mozilla.org/security/announce/2011/mfsa2011-29.htmlVendor Advisory
- http://www.mozilla.org/security/announce/2011/mfsa2011-31.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-33.html
- http://www.securityfocus.com/bid/49242
- https://bugzilla.mozilla.org/show_bug.cgi?id=665936
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
- http://secunia.com/advisories/49055
- http://www.mozilla.org/security/announce/2011/mfsa2011-29.htmlVendor Advisory
- http://www.mozilla.org/security/announce/2011/mfsa2011-31.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-33.html
- http://www.securityfocus.com/bid/49242
- https://bugzilla.mozilla.org/show_bug.cgi?id=665936
FAQ
What is CVE-2011-2988?
CVE-2011-2988 is a vulnerability with a CVSS score of 10.0 (HIGH). Buffer overflow in an unspecified string class in the WebGL shader implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products allows r...
How severe is CVE-2011-2988?
CVE-2011-2988 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-2988?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird.