PT-2011-4222 · Mozilla+1 · Thunderbird+3

Published 2011-08-16 · Updated 2017-09-19 · CVE-2011-2983

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.20 Thunderbird versions prior to 3.1.12 SeaMonkey versions 1.x and 2.x

Description The issue allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site. This is possibly related to a use-after-free error when handling the RegExp.input property.

Recommendations For Mozilla Firefox versions prior to 3.6.20, update to version 3.6.20 or later. For Thunderbird versions prior to 3.1.12, update to version 3.1.12 or later. For SeaMonkey versions 1.x and 2.x, consider disabling JavaScript or restricting access to untrusted websites until a fix is available. As a temporary workaround, consider disabling the use of the RegExp.input property in web applications until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-2983

DSA-2295-1

DSA-2296-1

DSA-2297-1

RHSA-2011:1164

RHSA-2011:1165

RHSA-2011:1167

RHSA-2011_1164

RHSA-2011_1165

RHSA-2011_1167

Affected Products

Firefox

Red Hat

Seamonkey

Thunderbird

References · 24

• http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2983 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-1164.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-1165.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2295 · Vendor Advisory
• http://debian.org/security/2011/dsa-2297 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-1167.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-1164.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:127 · Vendor Advisory
• http://mozilla.org/security/announce/2011/mfsa2011-30.html · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2011-2984 · Note
• https://access.redhat.com/security/cve/CVE-2011-2378 · Note
• https://access.redhat.com/security/cve/CVE-2011-2982 · Note