CVE-2011-3659
Mozilla Firefox <4.10 - Use After Free
Title source: llmDescription
Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/18870
metasploit
WORKING POC
NORMAL
by regenrecht · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb
References (7)
Scores
EPSS
0.7254
EPSS Percentile
98.8%
Details
CWE
CWE-416
Status
published
Products (10)
mozilla/firefox
< 3.6.26
mozilla/seamonkey
< 2.7
mozilla/thunderbird
< 3.1.18
opensuse/opensuse
11.4
suse/linux_enterprise_desktop
10 sp4
suse/linux_enterprise_desktop
11 sp1
suse/linux_enterprise_server
10 sp4
suse/linux_enterprise_server
11 sp1 (2 CPE variants)
suse/linux_enterprise_software_development_kit
10 sp4
suse/linux_enterprise_software_development_kit
11 sp1
Published
Feb 01, 2012
Tracked Since
Feb 18, 2026