CVE-2011-3658

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 70.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-12-21 · updated 2026-06-16
Weakness: CWE-399

Description

The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.

Affected products

Mozilla Firefox: 8.0
Mozilla Seamonkey: 2.5
Mozilla Thunderbird: 8.0

References

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html
http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
http://osvdb.org/77953
http://secunia.com/advisories/47302
http://secunia.com/advisories/47334
http://secunia.com/advisories/48495
http://secunia.com/advisories/48553
http://secunia.com/advisories/48823
http://secunia.com/advisories/49055
http://www.mandriva.com/security/advisories?name=MDVSA-2011:192
http://www.mandriva.com/security/advisories?name=MDVSA-2012:031

Get alerted when CVE-2011-3658 or the next vulnerability affects your stack