CVE-2011-3001

Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that triggers an unspecified internal error.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
4.0
mozillafirefox
4.0:beta1
mozillafirefox
4.0:beta10
mozillafirefox
4.0:beta11
mozillafirefox
4.0:beta12
mozillafirefox
4.0:beta2
mozillafirefox
4.0:beta3
mozillafirefox
4.0:beta4
mozillafirefox
4.0:beta5
mozillafirefox
4.0:beta6
mozillafirefox
4.0:beta7
mozillafirefox
4.0:beta8
mozillafirefox
4.0:beta9
mozillafirefox
4.0.1
mozillafirefox
5.0
mozillafirefox
6.0
mozillathunderbird
𝑥
≤ 6.0.2
mozillathunderbird
0.1
mozillathunderbird
0.2
mozillathunderbird
0.3
mozillathunderbird
0.4
mozillathunderbird
0.5
mozillathunderbird
0.6
mozillathunderbird
0.7
mozillathunderbird
0.7.1
mozillathunderbird
0.7.2
mozillathunderbird
0.7.3
mozillathunderbird
0.8
mozillathunderbird
0.9
mozillathunderbird
1.0
mozillathunderbird
1.0.1
mozillathunderbird
1.0.2
mozillathunderbird
1.0.3
mozillathunderbird
1.0.4
mozillathunderbird
1.0.5
mozillathunderbird
1.0.5:beta
mozillathunderbird
1.0.6
mozillathunderbird
1.0.7
mozillathunderbird
1.0.8
mozillathunderbird
1.5
mozillathunderbird
1.5:beta2
mozillathunderbird
1.5.0.1
mozillathunderbird
1.5.0.2
mozillathunderbird
1.5.0.3
mozillathunderbird
1.5.0.4
mozillathunderbird
1.5.0.5
mozillathunderbird
1.5.0.6
mozillathunderbird
1.5.0.7
mozillathunderbird
1.5.0.8
mozillathunderbird
1.5.0.9
mozillathunderbird
1.5.0.10
mozillathunderbird
1.5.0.11
mozillathunderbird
1.5.0.12
mozillathunderbird
1.5.0.13
mozillathunderbird
1.5.0.14
mozillathunderbird
1.5.1
mozillathunderbird
1.5.2
mozillathunderbird
1.7.1
mozillathunderbird
1.7.3
mozillathunderbird
2.0
mozillathunderbird
2.0.0.0
mozillathunderbird
2.0.0.1
mozillathunderbird
2.0.0.2
mozillathunderbird
2.0.0.3
mozillathunderbird
2.0.0.4
mozillathunderbird
2.0.0.5
mozillathunderbird
2.0.0.6
mozillathunderbird
2.0.0.7
mozillathunderbird
2.0.0.8
mozillathunderbird
2.0.0.9
mozillathunderbird
2.0.0.11
mozillathunderbird
2.0.0.12
mozillathunderbird
2.0.0.13
mozillathunderbird
2.0.0.14
mozillathunderbird
2.0.0.15
mozillathunderbird
2.0.0.16
mozillathunderbird
2.0.0.17
mozillathunderbird
2.0.0.18
mozillathunderbird
2.0.0.19
mozillathunderbird
2.0.0.20
mozillathunderbird
2.0.0.21
mozillathunderbird
2.0.0.22
mozillathunderbird
2.0.0.23
mozillathunderbird
2.0_.4:_.4
mozillathunderbird
2.0_.5:_.5
mozillathunderbird
2.0_.6:_.6
mozillathunderbird
2.0_.9:_.9
mozillathunderbird
2.0_.12:_.12
mozillathunderbird
2.0_.13:_.13
mozillathunderbird
2.0_.14:_.14
mozillathunderbird
2.0_8:_8
mozillathunderbird
3.0
mozillathunderbird
3.0.1
mozillathunderbird
3.0.2
mozillathunderbird
3.0.3
mozillathunderbird
3.0.4
mozillathunderbird
3.0.5
mozillathunderbird
3.0.6
mozillathunderbird
3.0.7
mozillathunderbird
3.0.8
mozillathunderbird
3.0.9
mozillathunderbird
3.0.10
mozillathunderbird
3.0.11
mozillathunderbird
3.1
mozillathunderbird
3.1.1
mozillathunderbird
3.1.2
mozillathunderbird
3.1.3
mozillathunderbird
3.1.4
mozillathunderbird
3.1.5
mozillathunderbird
3.1.6
mozillathunderbird
3.1.7
mozillathunderbird
3.1.8
mozillathunderbird
3.1.9
mozillathunderbird
3.1.10
mozillathunderbird
3.1.11
mozillathunderbird
5.0
mozillaseamonkey
𝑥
≤ 2.3.3
mozillaseamonkey
1.0
mozillaseamonkey
1.0
mozillaseamonkey
1.0
mozillaseamonkey
1.0
mozillaseamonkey
1.0:alpha
mozillaseamonkey
1.0:beta
mozillaseamonkey
1.0.1
mozillaseamonkey
1.0.2
mozillaseamonkey
1.0.3
mozillaseamonkey
1.0.4
mozillaseamonkey
1.0.5
mozillaseamonkey
1.0.6
mozillaseamonkey
1.0.7
mozillaseamonkey
1.0.8
mozillaseamonkey
1.0.9
mozillaseamonkey
1.0.99
mozillaseamonkey
1.1
mozillaseamonkey
1.1:alpha
mozillaseamonkey
1.1:beta
mozillaseamonkey
1.1.1
mozillaseamonkey
1.1.2
mozillaseamonkey
1.1.3
mozillaseamonkey
1.1.4
mozillaseamonkey
1.1.5
mozillaseamonkey
1.1.5:1.1.10
mozillaseamonkey
1.1.6
mozillaseamonkey
1.1.7
mozillaseamonkey
1.1.8
mozillaseamonkey
1.1.9
mozillaseamonkey
1.1.10
mozillaseamonkey
1.1.11
mozillaseamonkey
1.1.12
mozillaseamonkey
1.1.13
mozillaseamonkey
1.1.14
mozillaseamonkey
1.1.15
mozillaseamonkey
1.1.16
mozillaseamonkey
1.1.17
mozillaseamonkey
1.1.18
mozillaseamonkey
1.1.19
mozillaseamonkey
1.5.0.8
mozillaseamonkey
1.5.0.9
mozillaseamonkey
1.5.0.10
mozillaseamonkey
2.0
mozillaseamonkey
2.0:alpha_1
mozillaseamonkey
2.0:alpha_2
mozillaseamonkey
2.0:alpha_3
mozillaseamonkey
2.0:beta_1
mozillaseamonkey
2.0:beta_2
mozillaseamonkey
2.0:rc1
mozillaseamonkey
2.0:rc2
mozillaseamonkey
2.0.1
mozillaseamonkey
2.0.2
mozillaseamonkey
2.0.3
mozillaseamonkey
2.0.4
mozillaseamonkey
2.0.5
mozillaseamonkey
2.0.6
mozillaseamonkey
2.0.7
mozillaseamonkey
2.0.8
mozillaseamonkey
2.0.9
mozillaseamonkey
2.0.10
mozillaseamonkey
2.0.11
mozillaseamonkey
2.0.12
mozillaseamonkey
2.0.13
mozillaseamonkey
2.0.14
mozillaseamonkey
2.0a1:a1
mozillaseamonkey
2.0a1pre:a1pre
mozillaseamonkey
2.1:alpha1
mozillaseamonkey
2.1:alpha2
mozillaseamonkey
2.1:alpha3
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
hardy
ignored
lucid
not-affected
maverick
not-affected
natty
Fixed 7.0.1+build1+nobinonly-0ubuntu0.11.04.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
MozillaFirefox
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-devel
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-translations-common
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-translations-other
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaThunderbird
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
MozillaThunderbird-devel
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise workstation 15
52.8-1.2
fixed
MozillaThunderbird-translations-common
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
MozillaThunderbird-translations-other
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html
http://secunia.com/advisories/46315
http://www.mandriva.com/security/advisories?name=MDVSA-2011:139
http://www.mandriva.com/security/advisories?name=MDVSA-2011:140
http://www.mandriva.com/security/advisories?name=MDVSA-2011:141
http://www.mandriva.com/security/advisories?name=MDVSA-2011:142
http://www.mozilla.org/security/announce/2011/mfsa2011-40.html
https://bugzilla.mozilla.org/show_bug.cgi?id=672485
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14442
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00020.html
http://lists.opensuse.org/opensuse-updates/2011-10/msg00002.html
http://secunia.com/advisories/46315
http://www.mandriva.com/security/advisories?name=MDVSA-2011:139
http://www.mandriva.com/security/advisories?name=MDVSA-2011:140
http://www.mandriva.com/security/advisories?name=MDVSA-2011:141
http://www.mandriva.com/security/advisories?name=MDVSA-2011:142
http://www.mozilla.org/security/announce/2011/mfsa2011-40.html
https://bugzilla.mozilla.org/show_bug.cgi?id=672485
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14442