Use-after-free vulnerability in the nsHTMLSelectElement function in nsHTMLSelectElement.cpp in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allows remote attackers to execute arbitrary code via vectors involving removal of the parent node of an element.

The installed version of Thunderbird 8.x is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - An error exists related to plugins that can allow a NULL     pointer to be dereferenced when a plugin deletes its     containing DOM frame during a call from that frame. It     may be possible for a non-NULL pointer to be     dereferenced thereby opening up the potential for     further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Firefox 8.x is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - An error exists related to plugins that can allow a NULL     pointer to be dereferenced when a plugin deletes its     containing DOM frame during a call from that frame. It     may be possible for a non-NULL pointer to be     dereferenced thereby opening up the potential for     further exploitation. (CVE-2011-3664)

  - It is possible to crash the application when 'OGG'        'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of SeaMonkey is earlier than 2.6.0.  Such versions are potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.
    (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.
    (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Thunderbird is earlier than 9.0 and thus, is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.     (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.     (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

The installed version of Firefox is earlier than 9.0 and thus, is potentially affected by the following security issues :

  - An out-of-bounds memory access error exists in the     'SVG' implementation and can be triggered when 'SVG'     elements are removed during a 'DOMAttrModified' event     handler. (CVE-2011-3658)

  - Various memory safety errors exist that can lead to     memory corruption and possible code execution.     (CVE-2011-3660)

  - An error exists in the 'YARR' regular expression     library that can cause application crashes when     handling certain JavaScript statements. (CVE-2011-3661)

  - It is possible to detect keystrokes using 'SVG'     animation 'accesskey' events even when JavaScript is     disabled. (CVE-2011-3663)

  - It is possible to crash the application when 'OGG'     'video' elements are scaled to extreme sizes.     (CVE-2011-3665)

  - A use-after-free error exists related to the function     'nsHTMLSelectElement' that can allow arbitrary code     execution during operations such as removal of a     parent node of an element. (CVE-2011-3671)

ID	Name	Product	Family	Severity
57361	Thunderbird 8.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57359	Firefox 8.x Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
57353	SeaMonkey < 2.6.0 Multiple Vulnerabilities	Nessus	Windows	high
57352	Mozilla Thunderbird < 9.0 Multiple Vulnerabilities	Nessus	Windows	high
57351	Firefox < 9.0 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2011-3671

critical

Tenable Plugins

high

high

high

high

high