[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2011-2981Date: (C)2011-08-18   (M)2024-03-27


The event-management implementation in Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly select the context for script to run in, which allows remote attackers to bypass the Same Origin Policy or execute arbitrary JavaScript code with chrome privileges via a crafted web site.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 9.3
Exploit Score: 8.6
Impact Score: 10.0
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: COMPLETE
Integrity: COMPLETE
Availability: COMPLETE
  
Reference:
DSA-2295
DSA-2296
DSA-2297
MDVSA-2011:127
RHSA-2011:1164
SUSE-SA:2011:037
SUSE-SU-2011:0967
http://www.mozilla.org/security/announce/2011/mfsa2011-30.html
https://bugzilla.mozilla.org/show_bug.cgi?id=614151
https://bugzilla.mozilla.org/show_bug.cgi?id=643450
https://bugzilla.mozilla.org/show_bug.cgi?id=650252
oval:org.mitre.oval:def:14512

CPE    159
cpe:/a:mozilla:firefox:3.5.7
cpe:/a:mozilla:firefox:3.5.8
cpe:/a:mozilla:firefox:1.5:beta2
cpe:/a:mozilla:firefox:3.5.5
...
CWE    1
CWE-16
OVAL    19
oval:org.secpod.oval:def:201625
oval:org.secpod.oval:def:201573
oval:org.secpod.oval:def:201682
oval:org.secpod.oval:def:201445
...

© SecPod Technologies