PT-2011-4236 · Mozilla+1 · Firefox+1

Mark Kaplan · Published 2011-09-28 · Updated 2017-09-19 · CVE-2011-2998

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.6.x through 3.6.22

Description The issue is caused by an integer underflow in JavaScript code containing a large RegExp expression, which allows remote attackers to cause a denial of service or possibly execute arbitrary code.

Recommendations For Mozilla Firefox versions 3.6.x through 3.6.22, update to version 3.6.23 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2011-2998

DSA-2312-1

DSA-2313-1

DSA-2317-1

RHSA-2011:1341

RHSA-2011:1342

RHSA-2011:1343

RHSA-2011:1344

RHSA-2011_1341

RHSA-2011_1342

RHSA-2011_1343

RHSA-2011_1344

Affected Products

Firefox

Red Hat

References · 23

• http://redhat.com/support/errata/RHSA-2011-1341.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:141 · Vendor Advisory
• http://debian.org/security/2011/dsa-2312 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2317 · Vendor Advisory
• http://debian.org/security/2011/dsa-2313 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-1341.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2998 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-1342.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:139 · Vendor Advisory
• http://mozilla.org/security/announce/2011/mfsa2011-37.html · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2011-3000 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14012 · Note
• https://access.redhat.com/security/cve/CVE-2011-2995 · Note