Mozilla Firefox before 9.0, Thunderbird before 9.0, and SeaMonkey before 2.6 on Mac OS X do not properly handle certain DOM frame deletions by plugins, which allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) or possibly have unspecified other impact via a crafted web site.

Versions of Firefox prior to 9.0 are affected by the following security issues : 

 - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)
 - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)
 - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)
 - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)
 - An error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame.  It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)
 - It is possible to crash the application when OGG 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

The installed version of Thunderbird 8.x is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - An error exists related to plugins that can allow a NULL     pointer to be dereferenced when a plugin deletes its     containing DOM frame during a call from that frame. It     may be possible for a non-NULL pointer to be     dereferenced thereby opening up the potential for     further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Firefox 8.x is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - An error exists related to plugins that can allow a NULL     pointer to be dereferenced when a plugin deletes its     containing DOM frame during a call from that frame. It     may be possible for a non-NULL pointer to be     dereferenced thereby opening up the potential for     further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG'        'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

Versions of Mozilla Thunderbird prior to 9.0 are affected by the following security issues : 

 - An out-of-bounds memory access error exists in the 'SVG' implementation and can be triggered when 'SVG' elements are removed during a 'DOMAttrModified' event handler. (CVE-2011-3658)
 - Various memory safety errors exist that can lead to memory corruption and possible code execution. (CVE-2011-3660)
 - An error exists in the 'YARR' regular expression library that can cause application crashers when handling certain JavaScript statements. (CVE-2011-3661)
 - It is possible to detect keystrokes using 'SVG' animation 'accesskey' events even when JavaScript is disabled. (CVE-2011-3663)
 - AN error exists related to plugins that can allow a null pointer to be dereferenced when a plugin deletes its containing DOM frame during a call from that frame. It may be possible for a non-null pointer to be dereferenced thereby opening up the potential for further exploitation. (CVE-2011-3664)
 - It is possible to crash the application when 'OGG' 'video' elements are scaled to extreme sizes. (CVE-2011-3665)

ID	Name	Product	Family	Severity
6109	Mozilla Firefox < 9.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
57361	Thunderbird 8.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57359	Firefox 8.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
6110	Mozilla Thunderbird < 9.0 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	SMTP Clients	high

Detections

Analytics

CVE-2011-3664

high

Tenable Plugins

high

high

high

high