CVE-2011-3649

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-11-09 · updated 2026-06-16
Weakness: CWE-200

Description

Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D (aka D2D) API is used on Windows in conjunction with the Azure graphics back-end, allow remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas. NOTE: this issue exists because of a CVE-2011-2986 regression.

Affected products

Mozilla Firefox: 7.0
Mozilla Thunderbird: 7.0

References

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
http://www.mozilla.org/security/announce/2011/mfsa2011-50.html
http://www.securityfocus.com/bid/50591
https://bugzilla.mozilla.org/show_bug.cgi?id=655836
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14025
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
http://www.mozilla.org/security/announce/2011/mfsa2011-50.html
http://www.securityfocus.com/bid/50591
https://bugzilla.mozilla.org/show_bug.cgi?id=655836
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14025

Get alerted when CVE-2011-3649 or the next vulnerability affects your stack