← back
CVE-2011-0073

CVE-2011-0073

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 70%
from disclosure to weapon44 days
Published on NVDMay 7
1st PoC+44d
metasploitFeb 2
exploitation probability
70%top 1% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly use nsTreeRange data structures, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer."
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/17419unverifiedexploitdbwww.exploit-db.com/exploits/17520unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://downloads.avaya.com/css/P8/documents/100134543http://downloads.avaya.com/css/P8/documents/100144158https://bugzilla.mozilla.org/show_bug.cgi?id=630919http://securityreason.com/securityalert/8310https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14020http://www.debian.org/security/2011/dsa-2227http://www.debian.org/security/2011/dsa-2228http://www.debian.org/security/2011/dsa-2235http://www.mandriva.com/security/advisories?name=MDVSA-2011:079http://www.mozilla.org/security/announce/2011/mfsa2011-13.html