CVE-2011-3659

high · 9.3

Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes.

9.3

CVSS

36.8%

EPSS (exploit prob.)

98th

EPSS percentile

2012-02-01

Published

AV:N/AC:M/Au:N/C:C/I:C/A:C

Weaknesses

CWE-416

Affected products

Vendor	Product	Affected versions
mozilla	firefox	< 3.6.26
mozilla	firefox	>= 4.0, < 10.0
mozilla	seamonkey	< 2.7
mozilla	thunderbird	< 3.1.18
mozilla	thunderbird	>= 5.0, < 10.0
opensuse	opensuse	11.4
suse	linux_enterprise_desktop	10
suse	linux_enterprise_desktop	11
suse	linux_enterprise_server	10
suse	linux_enterprise_server	11
suse	linux_enterprise_server	11
suse	linux_enterprise_software_development_kit	10
suse	linux_enterprise_software_development_kit	11

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2011-3659