CVE-2011-3670

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-02-01 · updated 2026-06-16
Weakness: CWE-200

Description

Mozilla Firefox before 3.6.26 and 4.x through 6.0, Thunderbird before 3.1.18 and 5.0 through 6.0, and SeaMonkey before 2.4 do not properly enforce the IPv6 literal address syntax, which allows remote attackers to obtain sensitive information by making XMLHttpRequest calls through a proxy and reading the error messages.

Affected products

Mozilla Firefox: through 3.6.25; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+141)
Mozilla Seamonkey: through 2.4; 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3, 1.0.4 (+71)
Mozilla Thunderbird: through 3.1.7; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+83)

References

http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html
http://www.debian.org/security/2012/dsa-2400
http://www.debian.org/security/2012/dsa-2402
http://www.debian.org/security/2012/dsa-2406
http://www.mandriva.com/security/advisories?name=MDVSA-2012:013
http://www.mozilla.org/security/announce/2012/mfsa2012-02.html
https://bugzilla.mozilla.org/show_bug.cgi?id=504014
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14814
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html

Get alerted when CVE-2011-3670 or the next vulnerability affects your stack