CVE-2011-3866

Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
VendorProductVersion
mozillafirefox
𝑥
≤ 7.0
mozillaseamonkey
𝑥
< 2.4
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
natty
Fixed 7.0.1+build1+nobinonly-0ubuntu0.11.04.1
released
maverick
not-affected
lucid
not-affected
hardy
ignored
seamonkey
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
ignored
natty
ignored
maverick
ignored
lucid
ignored
hardy
ignored
Common Weakness Enumeration
References
http://www.mozilla.org/security/announce/2011/mfsa2011-45.html
http://www.usenix.org/events/hotsec11/tech/tech.html#Cai
https://bugzilla.mozilla.org/show_bug.cgi?id=682562
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13954
http://www.mozilla.org/security/announce/2011/mfsa2011-45.html
http://www.usenix.org/events/hotsec11/tech/tech.html#Cai
https://bugzilla.mozilla.org/show_bug.cgi?id=682562
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13954