CVEvulnerability
CVE-2011-2981
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2011-08-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-16
Description
The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site.
Affected configurations
• mozilla firefox (<= 3.6.19)
• mozilla firefox 1.0
• mozilla firefox 1.0.1
• mozilla firefox 1.0.2
• mozilla firefox 1.0.3
• mozilla firefox 1.0.4
• mozilla firefox 1.0.5
• mozilla firefox 1.0.6
• mozilla firefox 1.0.7
• mozilla firefox 1.0.8
• mozilla firefox 1.5
• mozilla firefox 1.5.0.1
• mozilla firefox 1.5.0.2
• mozilla firefox 1.5.0.3
• mozilla firefox 1.5.0.4
• mozilla firefox 1.5.0.5
• mozilla firefox 1.5.0.6
• mozilla firefox 1.5.0.7
• mozilla firefox 1.5.0.8
• mozilla firefox 1.5.0.9
• mozilla firefox 1.5.0.10
• mozilla firefox 1.5.0.11
• mozilla firefox 1.5.0.12
• mozilla firefox 1.5.1
• mozilla firefox 1.5.2
• mozilla firefox 1.5.3
• mozilla firefox 1.5.4
• mozilla firefox 1.5.5
• mozilla firefox 1.5.6
• mozilla firefox 1.5.7
• mozilla firefox 1.5.8
• mozilla firefox 2.0
• mozilla firefox 2.0.0.1
• mozilla firefox 2.0.0.2
• mozilla firefox 2.0.0.3
• mozilla firefox 2.0.0.4
• mozilla firefox 2.0.0.5
• mozilla firefox 2.0.0.6
• mozilla firefox 2.0.0.7
• mozilla firefox 2.0.0.8
• mozilla firefox 2.0.0.9
• mozilla firefox 2.0.0.10
• mozilla firefox 2.0.0.11
• mozilla firefox 2.0.0.12
• mozilla firefox 2.0.0.13
• mozilla firefox 2.0.0.14
• mozilla firefox 2.0.0.15
• mozilla firefox 2.0.0.16
• mozilla firefox 2.0.0.17
• mozilla firefox 2.0.0.18
• mozilla firefox 2.0.0.19
• mozilla firefox 2.0.0.20
• mozilla firefox 3.0
• mozilla firefox 3.0.1
• mozilla firefox 3.0.2
• mozilla firefox 3.0.3
• mozilla firefox 3.0.4
• mozilla firefox 3.0.5
• mozilla firefox 3.0.6
• mozilla firefox 3.0.7
… and 87 more
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html lists.opensuse.org
- http://www.debian.org/security/2011/dsa-2295 www.debian.org
- http://www.debian.org/security/2011/dsa-2296 www.debian.org
- http://www.debian.org/security/2011/dsa-2297 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:127 www.mandriva.com
- http://www.mozilla.org/security/announce/2011/mfsa2011-30.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1164.html Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=614151 bugzilla.mozilla.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=643450 bugzilla.mozilla.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=650252 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14512 oval.cisecurity.org
- http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html lists.opensuse.org
- http://www.debian.org/security/2011/dsa-2295 www.debian.org
- http://www.debian.org/security/2011/dsa-2296 www.debian.org
- http://www.debian.org/security/2011/dsa-2297 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:127 www.mandriva.com
- http://www.mozilla.org/security/announce/2011/mfsa2011-30.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1164.html Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=614151 bugzilla.mozilla.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=643450 bugzilla.mozilla.org
- https://bugzilla.mozilla.org/show_bug.cgi?id=650252 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14512 oval.cisecurity.org