critical9.3
CVE-2011-3647
The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScrip…
Impact
The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior, a related issue to CVE-2011-3004.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | through 3.6.23 Versions 0.1, 0.2, 0.3, 0.4, 0.5 |
| Mozilla | Thunderbird | through 3.1.5 Versions 0.1, 0.2, 0.3, 0.4, 0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-46.html
- http://www.redhat.com/support/errata/RHSA-2011-1439.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=680880
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13550
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-46.html
- http://www.redhat.com/support/errata/RHSA-2011-1439.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=680880
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13550