CVE-2011-2988

Firefox 4.x-5 and SeaMonkey < 2.3 - Remote Code Execution via WebGL Shader Source Code

Title source: llm

Description

Buffer overflow in an unspecified string class in the WebGL shader implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long source-code block for a shader.

References (8)

Core 8

Core References

Various Sources x_refsource_confirm

http://www.mozilla.org/security/announce/2011/mfsa2011-31.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14270

Various Sources x_refsource_confirm

http://www.mozilla.org/security/announce/2011/mfsa2011-33.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/49055

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/49242

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=665936

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2011/mfsa2011-29.html

Scores

EPSS 0.0544

EPSS Percentile 91.8%

Details

CWE

CWE-119

Status published

Products (20)

mozilla/firefox 4.0 (13 CPE variants)

mozilla/firefox 4.0.1

mozilla/firefox 5.0

mozilla/seamonkey 2.0 (8 CPE variants)

mozilla/seamonkey 2.0.1

mozilla/seamonkey 2.0.2

mozilla/seamonkey 2.0.3

mozilla/seamonkey 2.0.4

mozilla/seamonkey 2.0.5

mozilla/seamonkey 2.0.6

... and 10 more

Published Aug 18, 2011

Tracked Since Feb 18, 2026