PT-2011-4232 · Mozilla · Firefox+1

Published 2011-08-16 · Updated 2024-12-12 · CVE-2011-2993

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 5 SeaMonkey versions 2.x before 2.3

Description The issue concerns the implementation of digital signatures for JAR files, which does not prevent calls from unsigned JavaScript code to signed code. This allows remote attackers to bypass the Same Origin Policy and gain privileges via a crafted web site.

Recommendations For Mozilla Firefox versions 4.x through 5, update to a version that addresses this issue. For SeaMonkey versions 2.x before 2.3, update to version 2.3 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-2993

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

Affected Products

Firefox

Seamonkey

References · 2065

• http://mozilla.org/security/announce/2011/mfsa2011-29.html · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2011-29 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2993 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2993 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2023-6856 · Note
• https://suse.com/security/cve/CVE-2024-4778 · Note
• https://suse.com/security/cve/CVE-2019-11751 · Note
• https://suse.com/security/cve/CVE-2017-5441 · Note
• https://suse.com/security/cve/CVE-2023-6861 · Note
• https://suse.com/security/cve/CVE-2015-0817 · Note
• https://suse.com/security/cve/CVE-2021-23965 · Note
• https://suse.com/security/cve/CVE-2016-9899 · Note