CVE-2011-2370

Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 61.37%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
≤ 4.0.1
mozillafirefox_esr
𝑥
≤ 4.0.1
mozillafirefox
1.0
mozillafirefox_esr
1.0
mozillafirefox
1.0:preview_release
mozillafirefox_esr
1.0:preview_release
mozillafirefox
1.0.1
mozillafirefox_esr
1.0.1
mozillafirefox
1.0.2
mozillafirefox_esr
1.0.2
mozillafirefox
1.0.3
mozillafirefox_esr
1.0.3
mozillafirefox
1.0.4
mozillafirefox_esr
1.0.4
mozillafirefox
1.0.5
mozillafirefox_esr
1.0.5
mozillafirefox
1.0.6
mozillafirefox_esr
1.0.6
mozillafirefox
1.0.7
mozillafirefox_esr
1.0.7
mozillafirefox
1.0.8
mozillafirefox_esr
1.0.8
mozillafirefox
1.5
mozillafirefox_esr
1.5
mozillafirefox
1.5:beta1
mozillafirefox_esr
1.5:beta1
mozillafirefox
1.5:beta2
mozillafirefox_esr
1.5:beta2
mozillafirefox
1.5.0.1
mozillafirefox_esr
1.5.0.1
mozillafirefox
1.5.0.2
mozillafirefox_esr
1.5.0.2
mozillafirefox
1.5.0.3
mozillafirefox_esr
1.5.0.3
mozillafirefox
1.5.0.4
mozillafirefox_esr
1.5.0.4
mozillafirefox
1.5.0.5
mozillafirefox_esr
1.5.0.5
mozillafirefox
1.5.0.6
mozillafirefox_esr
1.5.0.6
mozillafirefox
1.5.0.7
mozillafirefox_esr
1.5.0.7
mozillafirefox
1.5.0.8
mozillafirefox_esr
1.5.0.8
mozillafirefox
1.5.0.9
mozillafirefox_esr
1.5.0.9
mozillafirefox
1.5.0.10
mozillafirefox_esr
1.5.0.10
mozillafirefox
1.5.0.11
mozillafirefox_esr
1.5.0.11
mozillafirefox
1.5.0.12
mozillafirefox_esr
1.5.0.12
mozillafirefox
1.5.1
mozillafirefox_esr
1.5.1
mozillafirefox
1.5.2
mozillafirefox_esr
1.5.2
mozillafirefox
1.5.3
mozillafirefox_esr
1.5.3
mozillafirefox
1.5.4
mozillafirefox_esr
1.5.4
mozillafirefox
1.5.5
mozillafirefox_esr
1.5.5
mozillafirefox
1.5.6
mozillafirefox_esr
1.5.6
mozillafirefox
1.5.7
mozillafirefox_esr
1.5.7
mozillafirefox
1.5.8
mozillafirefox_esr
1.5.8
mozillafirefox
2.0
mozillafirefox_esr
2.0
mozillafirefox
2.0.0.1
mozillafirefox_esr
2.0.0.1
mozillafirefox
2.0.0.2
mozillafirefox_esr
2.0.0.2
mozillafirefox
2.0.0.3
mozillafirefox_esr
2.0.0.3
mozillafirefox
2.0.0.4
mozillafirefox_esr
2.0.0.4
mozillafirefox
2.0.0.5
mozillafirefox_esr
2.0.0.5
mozillafirefox
2.0.0.6
mozillafirefox_esr
2.0.0.6
mozillafirefox
2.0.0.7
mozillafirefox_esr
2.0.0.7
mozillafirefox
2.0.0.8
mozillafirefox_esr
2.0.0.8
mozillafirefox
2.0.0.9
mozillafirefox_esr
2.0.0.9
mozillafirefox
2.0.0.10
mozillafirefox_esr
2.0.0.10
mozillafirefox
2.0.0.11
mozillafirefox_esr
2.0.0.11
mozillafirefox
2.0.0.12
mozillafirefox_esr
2.0.0.12
mozillafirefox
2.0.0.13
mozillafirefox_esr
2.0.0.13
mozillafirefox
2.0.0.14
mozillafirefox_esr
2.0.0.14
mozillafirefox
2.0.0.15
mozillafirefox_esr
2.0.0.15
mozillafirefox
2.0.0.16
mozillafirefox_esr
2.0.0.16
mozillafirefox
2.0.0.17
mozillafirefox_esr
2.0.0.17
mozillafirefox
2.0.0.18
mozillafirefox_esr
2.0.0.18
mozillafirefox
2.0.0.19
mozillafirefox_esr
2.0.0.19
mozillafirefox
2.0.0.20
mozillafirefox_esr
2.0.0.20
mozillafirefox
3.0
mozillafirefox_esr
3.0
mozillafirefox
3.0.1
mozillafirefox_esr
3.0.1
mozillafirefox
3.0.2
mozillafirefox_esr
3.0.2
mozillafirefox
3.0.3
mozillafirefox_esr
3.0.3
mozillafirefox
3.0.4
mozillafirefox_esr
3.0.4
mozillafirefox
3.0.5
mozillafirefox_esr
3.0.5
mozillafirefox
3.0.6
mozillafirefox_esr
3.0.6
mozillafirefox
3.0.7
mozillafirefox_esr
3.0.7
mozillafirefox
3.0.8
mozillafirefox_esr
3.0.8
mozillafirefox
3.0.9
mozillafirefox_esr
3.0.9
mozillafirefox
3.0.10
mozillafirefox_esr
3.0.10
mozillafirefox
3.0.11
mozillafirefox_esr
3.0.11
mozillafirefox
3.0.12
mozillafirefox_esr
3.0.12
mozillafirefox
3.0.13
mozillafirefox_esr
3.0.13
mozillafirefox
3.0.14
mozillafirefox_esr
3.0.14
mozillafirefox
3.0.15
mozillafirefox_esr
3.0.15
mozillafirefox
3.0.16
mozillafirefox_esr
3.0.16
mozillafirefox
3.0.17
mozillafirefox_esr
3.0.17
mozillafirefox
3.5
mozillafirefox_esr
3.5
mozillafirefox
3.5.1
mozillafirefox_esr
3.5.1
mozillafirefox
3.5.2
mozillafirefox_esr
3.5.2
mozillafirefox
3.5.3
mozillafirefox_esr
3.5.3
mozillafirefox
3.5.4
mozillafirefox_esr
3.5.4
mozillafirefox
3.5.5
mozillafirefox_esr
3.5.5
mozillafirefox
3.5.6
mozillafirefox_esr
3.5.6
mozillafirefox
3.5.7
mozillafirefox_esr
3.5.7
mozillafirefox
3.5.8
mozillafirefox_esr
3.5.8
mozillafirefox
3.5.9
mozillafirefox_esr
3.5.9
mozillafirefox
3.5.10
mozillafirefox_esr
3.5.10
mozillafirefox
3.5.11
mozillafirefox_esr
3.5.11
mozillafirefox
3.5.12
mozillafirefox_esr
3.5.12
mozillafirefox
3.5.13
mozillafirefox_esr
3.5.13
mozillafirefox
3.5.14
mozillafirefox_esr
3.5.14
mozillafirefox
3.5.15
mozillafirefox_esr
3.5.15
mozillafirefox
3.5.16
mozillafirefox_esr
3.5.16
mozillafirefox
3.5.17
mozillafirefox_esr
3.5.17
mozillafirefox
3.5.18
mozillafirefox_esr
3.5.18
mozillafirefox
3.5.19
mozillafirefox_esr
3.5.19
mozillafirefox
3.6
mozillafirefox_esr
3.6
mozillafirefox
3.6.2
mozillafirefox_esr
3.6.2
mozillafirefox
3.6.3
mozillafirefox_esr
3.6.3
mozillafirefox
3.6.4
mozillafirefox_esr
3.6.4
mozillafirefox
3.6.6
mozillafirefox_esr
3.6.6
mozillafirefox
3.6.7
mozillafirefox_esr
3.6.7
mozillafirefox
3.6.8
mozillafirefox_esr
3.6.8
mozillafirefox
3.6.9
mozillafirefox_esr
3.6.9
mozillafirefox
3.6.10
mozillafirefox_esr
3.6.10
mozillafirefox
3.6.11
mozillafirefox_esr
3.6.11
mozillafirefox
3.6.12
mozillafirefox_esr
3.6.12
mozillafirefox
3.6.13
mozillafirefox_esr
3.6.13
mozillafirefox
3.6.14
mozillafirefox_esr
3.6.14
mozillafirefox
3.6.15
mozillafirefox_esr
3.6.15
mozillafirefox
3.6.16
mozillafirefox_esr
3.6.16
mozillafirefox
3.6.17
mozillafirefox_esr
3.6.17
mozillafirefox
4.0
mozillafirefox_esr
4.0
mozillafirefox
4.0:beta1
mozillafirefox_esr
4.0:beta1
mozillafirefox
4.0:beta10
mozillafirefox_esr
4.0:beta10
mozillafirefox
4.0:beta11
mozillafirefox_esr
4.0:beta11
mozillafirefox
4.0:beta12
mozillafirefox_esr
4.0:beta12
mozillafirefox
4.0:beta2
mozillafirefox_esr
4.0:beta2
mozillafirefox
4.0:beta3
mozillafirefox_esr
4.0:beta3
mozillafirefox
4.0:beta4
mozillafirefox_esr
4.0:beta4
mozillafirefox
4.0:beta5
mozillafirefox_esr
4.0:beta5
mozillafirefox
4.0:beta6
mozillafirefox_esr
4.0:beta6
mozillafirefox
4.0:beta7
mozillafirefox_esr
4.0:beta7
mozillafirefox
4.0:beta8
mozillafirefox_esr
4.0:beta8
mozillafirefox
4.0:beta9
mozillafirefox_esr
4.0:beta9
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
hardy
ignored
lucid
not-affected
maverick
not-affected
natty
Fixed 5.0+build1+nobinonly-0ubuntu0.11.04.1
released
oneiric
not-affected
precise
not-affected
quantal
not-affected
firefox-3.0
hardy
ignored
lucid
dne
maverick
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
firefox-3.5
hardy
dne
lucid
dne
maverick
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
seamonkey
hardy
ignored
lucid
not-affected
maverick
not-affected
natty
not-affected
oneiric
not-affected
precise
dne
quantal
dne
thunderbird
hardy
ignored
lucid
not-affected
maverick
not-affected
natty
not-affected
oneiric
not-affected
precise
not-affected
quantal
not-affected
xulrunner-1.9.2
hardy
ignored
lucid
not-affected
maverick
not-affected
natty
not-affected
oneiric
dne
precise
dne
quantal
dne
xulrunner-2.0
hardy
dne
lucid
dne
maverick
dne
natty
ignored
oneiric
dne
precise
dne
quantal
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
MozillaFirefox
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-devel
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-translations-common
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-translations-other
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 15
52.7.3-1.35
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
http://www.mozilla.org/security/announce/2011/mfsa2011-28.html
https://bugzilla.mozilla.org/show_bug.cgi?id=645699
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14278
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
http://www.mozilla.org/security/announce/2011/mfsa2011-28.html
https://bugzilla.mozilla.org/show_bug.cgi?id=645699
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14278