What’s Vulnerable › Vulnerabilities

CVE-2011-3660

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2011-12-21 · updated 2026-06-16

Description

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors.

Affected products

• Mozilla Firefox: 4.0, 4.0-beta1, 4.0-beta10, 4.0-beta11, 4.0-beta12, 4.0-beta2 (+16)
• Mozilla Seamonkey: through 2.5; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+61)
• Mozilla Thunderbird: 5.0, 6.0, 6.0.1, 6.0.2, 7.0, 7.0.1 (+1)

References

• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html
• http://osvdb.org/77952
• http://secunia.com/advisories/47302
• http://secunia.com/advisories/47334
• http://secunia.com/advisories/49055
• http://www.mandriva.com/security/advisories?name=MDVSA-2011:192
• http://www.mozilla.org/security/announce/2011/mfsa2011-53.html
• http://www.securitytracker.com/id?1026445
• http://www.securitytracker.com/id?1026446
• http://www.securitytracker.com/id?1026447
• https://bugzilla.mozilla.org/show_bug.cgi?id=562442

Get alerted when CVE-2011-3660 or the next vulnerability affects your stack