CVE-2011-1712
Mozilla Firefox <3.5.19, 3.6.x <3.6.17, 4.x <4.0.1 - Info Disclosure
Title source: llmDescription
The txXPathNodeUtils::getXSLTId function in txMozillaXPathTreeWalker.cpp and txStandaloneXPathTreeWalker.cpp in Mozilla Firefox before 3.5.19, 3.6.x before 3.6.17, and 4.x before 4.0.1, and SeaMonkey before 2.0.14, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
References (5)
Core 5
Core References
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2011/mfsa2011-18.html
Patch x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=640339
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/66836
Exploit x_refsource_misc
http://scarybeastsecurity.blogspot.com/2011/03/multi-browser-heap-address-leak-in-xslt.html
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14467
Scores
EPSS
0.0107
EPSS Percentile
60.9%
Details
CWE
CWE-200
Status
published
Products (47)
mozilla/firefox
1.0 (2 CPE variants)
mozilla/firefox
1.0.1
mozilla/firefox
1.0.2
mozilla/firefox
1.0.3
mozilla/firefox
1.0.4
mozilla/firefox
1.0.5
mozilla/firefox
1.0.6
mozilla/firefox
1.0.7
mozilla/firefox
1.0.8
mozilla/firefox
1.5 (3 CPE variants)
... and 37 more
Published
Apr 15, 2011
Tracked Since
Feb 18, 2026