PT-2011-3816 · Mozilla+1 · Firefox+3

Moz_Bug_R_A4

·

Publicado

2011-08-16

·

Atualizado

2017-09-19

·

CVE-2011-2378

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.20 Thunderbird versions prior to 3.1.12 SeaMonkey versions 2.x
Description The issue is related to the appendChild function not properly handling DOM objects, allowing remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a "dangling pointer."
Recommendations For Mozilla Firefox versions prior to 3.6.20, update to version 3.6.20 or later. For Thunderbird versions prior to 3.1.12, update to version 3.1.12 or later. For SeaMonkey versions 2.x, consider disabling the appendChild function as a temporary workaround until a patch is available.

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-2378
DSA-2295-1
DSA-2296-1
DSA-2297-1
RHSA-2011:1164
RHSA-2011:1166
RHSA-2011_1164
RHSA-2011_1166
ZDI-11-271

Produtos afetados

Firefox
Red Hat
Seamonkey
Thunderbird