PT-2011-2053 · Mozilla+1 · Firefox+2

Bzbarsky + 4 · Published 2011-03-02 · Updated 2017-09-19 · CVE-2011-0059

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.5.17 Mozilla Firefox versions 3.6.x prior to 3.6.14 SeaMonkey versions prior to 2.0.12

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users for requests that were initiated by a plugin and received a 307 redirect to a page on a different web site.

Recommendations For Mozilla Firefox versions prior to 3.5.17, update to version 3.5.17 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.14, update to version 3.6.14 or later. For SeaMonkey versions prior to 2.0.12, update to version 2.0.12 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2011-0059

DSA-2180-1

DSA-2186-1

DSA-2187-1

RHSA-2011:0310

RHSA-2011:0313

RHSA-2011_0310

RHSA-2011_0313

Affected Products

Firefox

Red Hat

Seamonkey

References · 25

• https://bdu.fstec.ru/vul/2019-03338 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-0310.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:041 · Vendor Advisory
• http://mozilla.org/security/announce/2011/mfsa2011-10.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0059 · Security Note
• http://redhat.com/support/errata/RHSA-2011-0313.html · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2011-0056 · Note
• http://securityfocus.com/bid/46652 · Note
• https://access.redhat.com/security/cve/CVE-2010-1585 · Note
• https://access.redhat.com/security/cve/CVE-2011-0054 · Note
• https://access.redhat.com/security/cve/CVE-2011-0062 · Note
• https://access.redhat.com/security/cve/CVE-2011-0055 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=573873 · Note
• http://support.avaya.com/css/P8/documents/100128655 · Note
• https://access.redhat.com/security/cve/CVE-2011-0061 · Note