PT-2011-4239 · Mozilla+1 · Thunderbird+3

Mariusz Mlynski · Publicado 2011-09-27 · Atualizado 2024-06-15 · CVE-2011-3001

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 6 Thunderbird versions prior to 7.0 SeaMonkey versions prior to 2.4

Description The issue allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site. This occurs because the software does not prevent manual add-on installation when the Enter key is held, triggering an unspecified internal error.

Recommendations For Mozilla Firefox versions 4.x through 6, update to a version outside of this range to resolve the issue. For Thunderbird versions prior to 7.0, update to version 7.0 or later. For SeaMonkey versions prior to 2.4, update to version 2.4 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-3001

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10230-1

Produtos afetados

Firefox

Seamonkey

Suse

Thunderbird

Referências · 1932

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://suse.com/security/cve/CVE-2011-2365 · Nota