4.3 - CVE-2011-2369

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2011-2369	First vendor Publication	2011-06-30
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score	4.3	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 4.0.1 allows remote attackers to inject arbitrary web script or HTML via an SVG element containing an HTML-encoded entity.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2369

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:14008

Oval ID:	oval:org.mitre.oval:def:14008
Title:	USN-1157-3 -- firefox regression
Description:	firefox: Safe and easy web browser from Mozilla Details: USN-1157-1 fixed vulnerabilities in Firefox. Unfortunately, this update produced the side effect of pulling in Firefox on some systems that did not have it installed during a dist-upgrade due to changes in the Ubuntu language packs. This update fixes the problem. We apologize for the inconvenience. Original advisory under certain circumstances, the updated translations could unintentionally install firefox.
Family:	unix	Class:	patch
Reference(s):	USN-1157-3 CVE-2011-2374 CVE-2011-2375 CVE-2011-2373 CVE-2011-2377 CVE-2011-2371 CVE-2011-2366 CVE-2011-2367 CVE-2011-2368 CVE-2011-2370 CVE-2011-2369	Version:	5
Platform(s):	Ubuntu 11.04	Product(s):	firefox
Definition Synopsis:
Ubuntu 11.04 is installed AND Installed architecture is all Packages section firefox-locale-lg DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-lv DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-lt DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-pa DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-th DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ro DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-uk DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-te DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-pl DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ta DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-nl DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ja DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-nn DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-es DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-pt DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ml DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-zu DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-tr DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ru DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-nb DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-hi DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-zh-hant DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-fa DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-nso DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-br DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-bs DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-zh-hans DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-fi DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-he DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-hy DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-mk DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-fr DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-hr DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-de DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-sr DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-fy DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-hu DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-gu DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-bn DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-mr DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-or DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-sl DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-sk DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-as DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-si DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-sv DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-da DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-sq DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-oc DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-cs DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-is DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-cy DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ko DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-kn DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ga DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ar DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-kk DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-gd DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-eu DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-et DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-id DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ka DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-gl DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-el DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-eo DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-en DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-mai DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-be DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ca DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-af DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-vi DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ku DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-bg DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-it DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2 AND firefox-locale-ast DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.2

Definition Id: oval:org.mitre.oval:def:14048

Oval ID:	oval:org.mitre.oval:def:14048
Title:	USN-1157-2 -- mozvoikko, ubufox, webfav update
Description:	mozvoikko: Finnish spell-checker extension for Firefox - ubufox: Ubuntu Firefox specific configuration defaults and apt support - webfav: Firefox extension for saving web favorites Details: USN-1157-1 fixed vulnerabilities in Firefox. This update provides updated packages for use with Firefox 5. Original advisory This update provides provides packages compatible with Firefox 5.
Family:	unix	Class:	patch
Reference(s):	USN-1157-2 CVE-2011-2374 CVE-2011-2375 CVE-2011-2373 CVE-2011-2377 CVE-2011-2371 CVE-2011-2366 CVE-2011-2367 CVE-2011-2368 CVE-2011-2370 CVE-2011-2369	Version:	5
Platform(s):	Ubuntu 11.04	Product(s):	mozvoikko ubufox webfav
Definition Synopsis:
Ubuntu 11.04 is installed AND Installed architecture is all Packages section xul-ext-webfav DPKG is earlier than 1.17-0ubuntu5.1 AND xul-ext-ubufox DPKG is earlier than 0.9.1-0ubuntu0.11.04.1 AND xul-ext-mozvoikko DPKG is earlier than 1.9.0~svn20101114r3591-0ubuntu3.11.04.1

Definition Id: oval:org.mitre.oval:def:14068

Oval ID:	oval:org.mitre.oval:def:14068
Title:	USN-1157-1 -- firefox vulnerabilities
Description:	firefox: Safe and easy web browser from Mozilla Multiple Firefox vulnerabilities have been fixed
Family:	unix	Class:	patch
Reference(s):	USN-1157-1 CVE-2011-2374 CVE-2011-2375 CVE-2011-2373 CVE-2011-2377 CVE-2011-2371 CVE-2011-2366 CVE-2011-2367 CVE-2011-2368 CVE-2011-2370 CVE-2011-2369	Version:	5
Platform(s):	Ubuntu 11.04	Product(s):	firefox
Definition Synopsis:
Ubuntu 11.04 is installed AND Installed architecture is all AND firefox DPKG is earlier than 5.0+build1+nobinonly-0ubuntu0.11.04.1

Definition Id: oval:org.mitre.oval:def:14426

Oval ID:	oval:org.mitre.oval:def:14426
Title:	Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 4.0.1 allows remote attackers to inject arbitrary web script or HTML via an SVG element containing an HTML-encoded entity.
Description:	Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 4.0.1 allows remote attackers to inject arbitrary web script or HTML via an SVG element containing an HTML-encoded entity.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2011-2369	Version:	11
Platform(s):	Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP Microsoft Windows 2000	Product(s):	Mozilla Firefox
Definition Synopsis:
Determine if the version of Mozilla Firefox is equal to 4.0 Mozilla Firefox Mainline release is installed AND Check for vulnerable version Mozilla Firefox Mainline version is equal to 4.0

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mozilla Firefox cpe:2.3:a:mozilla:firefox:4.0.1:::::::* cpe:2.3:a:mozilla:firefox:4.0:beta1:::::: cpe:2.3:a:mozilla:firefox:4.0:beta6:::::: cpe:2.3:a:mozilla:firefox:4.0:beta3:::::: cpe:2.3:a:mozilla:firefox:4.0:beta5:::::: cpe:2.3:a:mozilla:firefox:4.0:beta4:::::: cpe:2.3:a:mozilla:firefox:4.0:beta2:::::: cpe:2.3:a:mozilla:firefox:4.0:beta12:::::: cpe:2.3:a:mozilla:firefox:4.0:-:::::: cpe:2.3:a:mozilla:firefox:4.0:beta11:::::: cpe:2.3:a:mozilla:firefox:4.0:beta10:::::: cpe:2.3:a:mozilla:firefox:4.0:beta7:::::: cpe:2.3:a:mozilla:firefox:4.0:beta8:::::: cpe:2.3:a:mozilla:firefox:4.0:beta9::::::	14

OpenVAS Exploits

Date	Description
2011-08-18	Name : SuSE Update for MozillaFirefox,MozillaThunderbird SUSE-SA:2011:028 File : nvt/gb_suse_2011_028.nasl
2011-08-03	Name : FreeBSD Ports: firefox File : nvt/freebsd_firefox57.nasl
2011-07-07	Name : Mozilla Firefox Multiple Vulnerabilities July-11 (Windows) File : nvt/gb_mozilla_firefox_mult_vuln_win_jul11.nasl
2011-06-24	Name : Ubuntu Update for firefox USN-1157-1 File : nvt/gb_ubuntu_USN_1157_1.nasl
2011-06-24	Name : Ubuntu Update for mozvoikko USN-1157-2 File : nvt/gb_ubuntu_USN_1157_2.nasl
2011-06-24	Name : Ubuntu Update for firefox USN-1157-3 File : nvt/gb_ubuntu_USN_1157_3.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
73192	Mozilla Multiple Products HTML-encoded Entities SVG Elements XSS

Nessus® Vulnerability Scanner

Date	Description
2013-01-08	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2011-08-17	Name : The remote Windows host contains a web browser that may be affected by multip... File : seamonkey_22.nasl - Type : ACT_GATHER_INFO
2011-06-24	Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_5_0.nasl - Type : ACT_GATHER_INFO
2011-06-24	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1157-3.nasl - Type : ACT_GATHER_INFO
2011-06-23	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1157-1.nasl - Type : ACT_GATHER_INFO
2011-06-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1157-2.nasl - Type : ACT_GATHER_INFO
2011-06-21	Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_50.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
http://www.mozilla.org/security/announce/2011/mfsa2011-27.html
https://bugzilla.mozilla.org/show_bug.cgi?id=650001
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 23:04:48	Multiple Updates
2024-11-28 12:25:59	Multiple Updates
2024-08-02 12:16:45	Multiple Updates
2024-08-02 01:04:45	Multiple Updates
2024-02-02 01:16:16	Multiple Updates
2024-02-01 12:04:39	Multiple Updates
2023-09-05 12:15:14	Multiple Updates
2023-09-05 01:04:31	Multiple Updates
2023-09-02 12:15:19	Multiple Updates
2023-09-02 01:04:35	Multiple Updates
2023-08-12 12:18:29	Multiple Updates
2023-08-12 01:04:36	Multiple Updates
2023-08-11 12:15:23	Multiple Updates
2023-08-11 01:04:44	Multiple Updates
2023-08-06 12:14:47	Multiple Updates
2023-08-06 01:04:37	Multiple Updates
2023-08-04 12:14:52	Multiple Updates
2023-08-04 01:04:38	Multiple Updates
2023-07-14 12:14:51	Multiple Updates
2023-07-14 01:04:35	Multiple Updates
2023-03-29 01:16:46	Multiple Updates
2023-03-28 12:04:41	Multiple Updates
2022-10-11 12:13:14	Multiple Updates
2022-10-11 01:04:21	Multiple Updates
2021-05-04 12:14:38	Multiple Updates
2021-04-22 01:15:56	Multiple Updates
2020-05-23 00:28:50	Multiple Updates
2017-09-19 09:24:30	Multiple Updates
2016-04-26 20:50:18	Multiple Updates
2014-02-17 11:03:01	Multiple Updates
2013-05-10 23:02:14	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	4
CPE ID(s)	14
Sources(s)	4
osvdb(s)	1
Openvas Exploit(s)	6
Nessus® Exploit(s)	7

	Related
10	USN-1157-3
10	USN-1157-2
10	USN-1157-1
10	GLSA-201301-01
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)