Lucene search
HistoryJun 30, 2011 - 4:55 p.m.
CVE-2011-2605
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.7 Medium
AI Score
Confidence
Low
0.398 Low
EPSS
Percentile
97.3%
CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript “document.cookie =” expression, a different vulnerability than CVE-2011-2374.
Affected configurations
Node
mozillafirefoxRange≤3.6.17
ORmozillafirefoxMatch1.0
ORmozillafirefoxMatch1.0preview_release
ORmozillafirefoxMatch1.0.1
ORmozillafirefoxMatch1.0.2
ORmozillafirefoxMatch1.0.3
ORmozillafirefoxMatch1.0.4
ORmozillafirefoxMatch1.0.5
ORmozillafirefoxMatch1.0.6
ORmozillafirefoxMatch1.0.7
ORmozillafirefoxMatch1.0.8
ORmozillafirefoxMatch1.5
ORmozillafirefoxMatch1.5beta1
ORmozillafirefoxMatch1.5beta2
ORmozillafirefoxMatch1.5.0.1
ORmozillafirefoxMatch1.5.0.2
ORmozillafirefoxMatch1.5.0.3
ORmozillafirefoxMatch1.5.0.4
ORmozillafirefoxMatch1.5.0.5
ORmozillafirefoxMatch1.5.0.6
ORmozillafirefoxMatch1.5.0.7
ORmozillafirefoxMatch1.5.0.8
ORmozillafirefoxMatch1.5.0.9
ORmozillafirefoxMatch1.5.0.10
ORmozillafirefoxMatch1.5.0.11
ORmozillafirefoxMatch1.5.0.12
ORmozillafirefoxMatch1.5.1
ORmozillafirefoxMatch1.5.2
ORmozillafirefoxMatch1.5.3
ORmozillafirefoxMatch1.5.4
ORmozillafirefoxMatch1.5.5
ORmozillafirefoxMatch1.5.6
ORmozillafirefoxMatch1.5.7
ORmozillafirefoxMatch1.5.8
ORmozillafirefoxMatch2.0
ORmozillafirefoxMatch2.0.0.1
ORmozillafirefoxMatch2.0.0.2
ORmozillafirefoxMatch2.0.0.3
ORmozillafirefoxMatch2.0.0.4
ORmozillafirefoxMatch2.0.0.5
ORmozillafirefoxMatch2.0.0.6
ORmozillafirefoxMatch2.0.0.7
ORmozillafirefoxMatch2.0.0.8
ORmozillafirefoxMatch2.0.0.9
ORmozillafirefoxMatch2.0.0.10
ORmozillafirefoxMatch2.0.0.11
ORmozillafirefoxMatch2.0.0.12
ORmozillafirefoxMatch2.0.0.13
ORmozillafirefoxMatch2.0.0.14
ORmozillafirefoxMatch2.0.0.15
ORmozillafirefoxMatch2.0.0.16
ORmozillafirefoxMatch2.0.0.17
ORmozillafirefoxMatch2.0.0.18
ORmozillafirefoxMatch2.0.0.19
ORmozillafirefoxMatch2.0.0.20
ORmozillafirefoxMatch3.0
ORmozillafirefoxMatch3.0.1
ORmozillafirefoxMatch3.0.2
ORmozillafirefoxMatch3.0.3
ORmozillafirefoxMatch3.0.4
ORmozillafirefoxMatch3.0.5
ORmozillafirefoxMatch3.0.6
ORmozillafirefoxMatch3.0.7
ORmozillafirefoxMatch3.0.8
ORmozillafirefoxMatch3.0.9
ORmozillafirefoxMatch3.0.10
ORmozillafirefoxMatch3.0.11
ORmozillafirefoxMatch3.0.12
ORmozillafirefoxMatch3.0.13
ORmozillafirefoxMatch3.0.14
ORmozillafirefoxMatch3.0.15
ORmozillafirefoxMatch3.0.16
ORmozillafirefoxMatch3.0.17
ORmozillafirefoxMatch3.5
ORmozillafirefoxMatch3.5.1
ORmozillafirefoxMatch3.5.2
ORmozillafirefoxMatch3.5.3
ORmozillafirefoxMatch3.5.4
ORmozillafirefoxMatch3.5.5
ORmozillafirefoxMatch3.5.6
ORmozillafirefoxMatch3.5.7
ORmozillafirefoxMatch3.5.8
ORmozillafirefoxMatch3.5.9
ORmozillafirefoxMatch3.5.10
ORmozillafirefoxMatch3.5.11
ORmozillafirefoxMatch3.5.12
ORmozillafirefoxMatch3.5.13
ORmozillafirefoxMatch3.5.14
ORmozillafirefoxMatch3.5.15
ORmozillafirefoxMatch3.5.16
ORmozillafirefoxMatch3.5.17
ORmozillafirefoxMatch3.5.18
ORmozillafirefoxMatch3.5.19
ORmozillafirefoxMatch3.6
ORmozillafirefoxMatch3.6.2
ORmozillafirefoxMatch3.6.3
ORmozillafirefoxMatch3.6.4
ORmozillafirefoxMatch3.6.6
ORmozillafirefoxMatch3.6.7
ORmozillafirefoxMatch3.6.8
ORmozillafirefoxMatch3.6.9
ORmozillafirefoxMatch3.6.10
ORmozillafirefoxMatch3.6.11
ORmozillafirefoxMatch3.6.12
ORmozillafirefoxMatch3.6.13
ORmozillafirefoxMatch3.6.14
ORmozillafirefoxMatch3.6.15
ORmozillafirefoxMatch3.6.16
Node
mozillathunderbirdRange≤3.1.10
ORmozillathunderbirdMatch0.1
ORmozillathunderbirdMatch0.2
ORmozillathunderbirdMatch0.3
ORmozillathunderbirdMatch0.4
ORmozillathunderbirdMatch0.5
ORmozillathunderbirdMatch0.6
ORmozillathunderbirdMatch0.7
ORmozillathunderbirdMatch0.7.1
ORmozillathunderbirdMatch0.7.2
ORmozillathunderbirdMatch0.7.3
ORmozillathunderbirdMatch0.8
ORmozillathunderbirdMatch0.9
ORmozillathunderbirdMatch1.0
ORmozillathunderbirdMatch1.0.1
ORmozillathunderbirdMatch1.0.2
ORmozillathunderbirdMatch1.0.3
ORmozillathunderbirdMatch1.0.4
ORmozillathunderbirdMatch1.0.5
ORmozillathunderbirdMatch1.0.6
ORmozillathunderbirdMatch1.0.7
ORmozillathunderbirdMatch1.0.8
ORmozillathunderbirdMatch1.5
ORmozillathunderbirdMatch1.5beta2
ORmozillathunderbirdMatch1.5.0.1
ORmozillathunderbirdMatch1.5.0.2
ORmozillathunderbirdMatch1.5.0.3
ORmozillathunderbirdMatch1.5.0.4
ORmozillathunderbirdMatch1.5.0.5
ORmozillathunderbirdMatch1.5.0.6
ORmozillathunderbirdMatch1.5.0.7
ORmozillathunderbirdMatch1.5.0.8
ORmozillathunderbirdMatch1.5.0.9
ORmozillathunderbirdMatch1.5.0.10
ORmozillathunderbirdMatch1.5.0.11
ORmozillathunderbirdMatch1.5.0.12
ORmozillathunderbirdMatch1.5.0.13
ORmozillathunderbirdMatch1.5.0.14
ORmozillathunderbirdMatch1.5.1
ORmozillathunderbirdMatch1.5.2
ORmozillathunderbirdMatch1.7.1
ORmozillathunderbirdMatch1.7.3
ORmozillathunderbirdMatch2.0
ORmozillathunderbirdMatch2.0.0.0
ORmozillathunderbirdMatch2.0.0.1
ORmozillathunderbirdMatch2.0.0.2
ORmozillathunderbirdMatch2.0.0.3
ORmozillathunderbirdMatch2.0.0.4
ORmozillathunderbirdMatch2.0.0.5
ORmozillathunderbirdMatch2.0.0.6
ORmozillathunderbirdMatch2.0.0.7
ORmozillathunderbirdMatch2.0.0.8
ORmozillathunderbirdMatch2.0.0.9
ORmozillathunderbirdMatch2.0.0.12
ORmozillathunderbirdMatch2.0.0.14
ORmozillathunderbirdMatch2.0.0.16
ORmozillathunderbirdMatch2.0.0.17
ORmozillathunderbirdMatch2.0.0.18
ORmozillathunderbirdMatch2.0.0.19
ORmozillathunderbirdMatch2.0.0.21
ORmozillathunderbirdMatch2.0.0.22
ORmozillathunderbirdMatch2.0.0.23
ORmozillathunderbirdMatch3.0
ORmozillathunderbirdMatch3.0.1
ORmozillathunderbirdMatch3.0.2
ORmozillathunderbirdMatch3.0.3
ORmozillathunderbirdMatch3.0.4
ORmozillathunderbirdMatch3.0.5
ORmozillathunderbirdMatch3.0.6
ORmozillathunderbirdMatch3.0.7
ORmozillathunderbirdMatch3.0.8
ORmozillathunderbirdMatch3.0.9
ORmozillathunderbirdMatch3.0.10
ORmozillathunderbirdMatch3.0.11
ORmozillathunderbirdMatch3.1
ORmozillathunderbirdMatch3.1.1
ORmozillathunderbirdMatch3.1.2
ORmozillathunderbirdMatch3.1.3
ORmozillathunderbirdMatch3.1.4
ORmozillathunderbirdMatch3.1.5
ORmozillathunderbirdMatch3.1.6
ORmozillathunderbirdMatch3.1.7
ORmozillathunderbirdMatch3.1.8
ORmozillathunderbirdMatch3.1.9
Node
mozillafirefoxMatch4.0
ORmozillafirefoxMatch4.0beta1
ORmozillafirefoxMatch4.0beta10
ORmozillafirefoxMatch4.0beta11
ORmozillafirefoxMatch4.0beta12
ORmozillafirefoxMatch4.0beta2
ORmozillafirefoxMatch4.0beta3
ORmozillafirefoxMatch4.0beta4
ORmozillafirefoxMatch4.0beta5
ORmozillafirefoxMatch4.0beta6
ORmozillafirefoxMatch4.0beta7
ORmozillafirefoxMatch4.0beta8
ORmozillafirefoxMatch4.0beta9
ORmozillafirefoxMatch4.0.1
References
www.mozilla.org/security/announce/2011/mfsa2011-19.html
www.redhat.com/support/errata/RHSA-2011-0885.html
www.redhat.com/support/errata/RHSA-2011-0886.html
www.redhat.com/support/errata/RHSA-2011-0887.html
www.redhat.com/support/errata/RHSA-2011-0888.html
bugzilla.mozilla.org/show_bug.cgi?id=643051
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14401
Related
prion
prion
Crlf injection
2011-06-30 16:55:00
Memory corruption
2011-06-30 16:55:00
cvelist
cvelist
CVE-2011-2605
2011-06-30 16:00:00
CVE-2011-2374
2011-06-30 16:00:00
openvas
openvas
Mozilla Products Multiple Vulnerabilities July-11 (Windows) - 02
2011-07-07 00:00:00
Mozilla Products Multiple Vulnerabilities - 02 - (Jul 2011) - Windows
2011-07-07 00:00:00
Debian: Security Advisory (DSA-2268-1)
2011-08-03 00:00:00
cve
cve
CVE-2011-2605
2011-06-30 16:55:05
CVE-2011-2374
2011-06-30 16:55:05
ubuntucve
ubuntucve
CVE-2011-2605
2011-06-30 00:00:00
CVE-2011-2374
2011-06-24 00:00:00
veracode
veracode
CRLF Injection
2020-04-10 00:58:24
Arbitrary Code Execution
2020-04-10 00:58:22
nvd
nvd
CVE-2011-2374
2011-06-30 16:55:05
seebug
seebug
Mozilla Firefox/Thunderbird内存破坏漏洞(CVE-2011-2374)
2011-06-25 00:00:00
nessus
nessus
Mozilla Firefox 3.6.x < 3.6.18 Multiple Vulnerabilities
2011-06-21 00:00:00
RHEL 6 : thunderbird (RHSA-2011:0886)
2011-06-22 00:00:00
Mozilla Firefox > 4.0 and < 5.0 Multiple Vulnerabilities
2011-06-21 00:00:00
oraclelinux
oraclelinux
thunderbird security update
2011-06-21 00:00:00
seamonkey security update
2011-06-21 00:00:00
thunderbird security update
2011-06-21 00:00:00
redhat
redhat
(RHSA-2011:0886) Critical: thunderbird security update
2011-06-21 00:00:00
(RHSA-2011:0887) Critical: thunderbird security update
2011-06-21 00:00:00
(RHSA-2011:0885) Critical: firefox security and bug fix update
2011-06-21 00:00:00
centos
centos
firefox, xulrunner security update
2011-06-22 23:42:39
thunderbird security update
2011-06-22 23:49:49
seamonkey security update
2011-08-14 21:51:22
mozilla
mozilla
Miscellaneous memory safety hazards (rv:3.0/1.9.2.18) — Mozilla
2011-06-21 00:00:00
osv
osv
iceape - several
2011-07-01 00:00:00
iceweasel - several
2011-07-01 00:00:00
icedove - multiple issues
2011-07-06 00:00:00
debian
debian
[BSA-040] Security Update for iceweasel
2011-07-04 07:11:09
[SECURITY] [DSA 2268-1] iceweasel security update
2011-07-01 19:32:42
[SECURITY] [DSA 2269-1] iceape security update
2011-07-01 20:16:48
ubuntu
ubuntu
Firefox vulnerabilities
2011-06-22 00:00:00
mozvoikko, ubufox, webfav update
2011-06-22 00:00:00
Firefox regression
2011-06-23 00:00:00
suse
suse
MozillaThunderbird: Update to Thunderbird 3.1.11 (important)
2011-06-30 21:08:16
Security update for Mozilla Firefox (important)
2011-06-30 23:08:22
remote code execution in MozillaFirefox,MozillaThunderbird
2011-07-05 17:43:33
securityvulns
securityvulns
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
2011-06-23 00:00:00
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2013-01-08 00:00:00
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.7 Medium
AI Score
Confidence
Low
0.398 Low
EPSS
Percentile
97.3%
Related for NVD:CVE-2011-2605