Vulnerability Details CVE-2011-3655
Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0 through 7.0 perform access control without checking for use of the NoWaiverWrapper wrapper, which allows remote attackers to gain privileges via a crafted web site.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 78.5%
CVSS Severity
CVSS v2 Score 9.3
References
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
- http://secunia.com/advisories/49055
- http://www.mozilla.org/security/announce/2011/mfsa2011-52.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=672182
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14202
- http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
- http://secunia.com/advisories/49055
- http://www.mozilla.org/security/announce/2011/mfsa2011-52.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=672182
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14202
Products affected by CVE-2011-3655
-
cpe:2.3:a:mozilla:firefox:4.0
-
cpe:2.3:a:mozilla:firefox:4.0.1
-
cpe:2.3:a:mozilla:firefox:5.0
-
cpe:2.3:a:mozilla:firefox:5.0.1
-
cpe:2.3:a:mozilla:firefox:6.0
-
cpe:2.3:a:mozilla:firefox:6.0.1
-
cpe:2.3:a:mozilla:firefox:6.0.2
-
cpe:2.3:a:mozilla:firefox:7.0
-
cpe:2.3:a:mozilla:thunderbird:5.0
-
cpe:2.3:a:mozilla:thunderbird:6.0
-
cpe:2.3:a:mozilla:thunderbird:6.0.1
-
cpe:2.3:a:mozilla:thunderbird:6.0.2
-
cpe:2.3:a:mozilla:thunderbird:7.0