Vulnerability Description
Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 3.6.26 |
| Mozilla | Seamonkey | < 2.7 |
| Mozilla | Thunderbird | < 3.1.18 |
| Opensuse | Opensuse | 11.4 |
| Suse | Linux Enterprise Desktop | 10 |
| Suse | Linux Enterprise Server | 10 |
| Suse | Linux Enterprise Software Development Kit | 10 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.htmlMailing ListThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:013Third Party Advisory
- http://www.mozilla.org/security/announce/2012/mfsa2012-04.htmlVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=708198ExploitIssue TrackingPatch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.htmlMailing ListThird Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:013Third Party Advisory
- http://www.mozilla.org/security/announce/2012/mfsa2012-04.htmlVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=708198ExploitIssue TrackingPatch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Third Party Advisory
FAQ
What is CVE-2011-3659?
CVE-2011-3659 is a vulnerability with a CVSS score of 9.3 (HIGH). Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbit...
How severe is CVE-2011-3659?
CVE-2011-3659 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-3659?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird, Opensuse Opensuse, Suse Linux Enterprise Desktop.