CVE-2011-2993

HIGH

Description

The implementation of digital signatures for JAR files in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not prevent calls from unsigned JavaScript code to signed code, which allows remote attackers to bypass the Same Origin Policy and gain privileges via a crafted web site, a different vulnerability than CVE-2008-2801.

References

http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html

http://www.mozilla.org/security/announce/2011/mfsa2011-29.html

http://www.mozilla.org/security/announce/2011/mfsa2011-33.html

https://bugzilla.mozilla.org/show_bug.cgi?id=657267

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14055

Details

Source: MITRE

Published: 2011-08-18

Updated: 2017-09-19

Type: CWE-264

Risk Information

CVSS v2.0

Base Score: 9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 8.6

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:5.0:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:alpha1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:alpha2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:alpha3:*:*:*:*:*:*

Tenable Plugins

View all (14 total)

IDNameProductFamilySeverity
76020openSUSE Security Update : seamonkey (openSUSE-SU-2011:0957-1)NessusSuSE Local Security Checks
critical
75945openSUSE Security Update : MozillaFirefox (openSUSE-SU-2011:0957-2)NessusSuSE Local Security Checks
critical
75739openSUSE Security Update : seamonkey (openSUSE-SU-2011:0957-1)NessusSuSE Local Security Checks
critical
63402GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)NessusGentoo Local Security Checks
critical
56562Ubuntu 11.04 : libvoikko regression (USN-1192-3)NessusUbuntu Local Security Checks
critical
801346Mozilla Firefox 5.0 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801272Mozilla SeaMonkey 2.x < 2.3.0 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
6012SeaMonkey 2.x < 2.3.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
6008Mozilla Firefox < 6.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
55902Firefox < 6.0 Multiple VulnerabilitiesNessusWindows
high
55899Ubuntu 11.04 : mozvoikko update (USN-1192-2)NessusUbuntu Local Security Checks
critical
55898Ubuntu 11.04 : firefox vulnerabilities (USN-1192-1)NessusUbuntu Local Security Checks
critical
55885SeaMonkey < 2.3.0 Multiple VulnerabilitiesNessusWindows
high
55878FreeBSD : mozilla -- multiple vulnerabilities (834591a9-c82f-11e0-897d-6c626dd55a41)NessusFreeBSD Local Security Checks
critical