CVE-2011-2367

The WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict read operations, which allows remote attackers to obtain sensitive information from GPU memory associated with an arbitrary process, or cause a denial of service (application crash), via unspecified vectors.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
http://www.mozilla.org/security/announce/2011/mfsa2011-26.html	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=656752
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14302

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox:4.0:::::::*
	cpe:2.3:a:mozilla:firefox:4.0:beta1::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta10::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta11::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta12::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta2::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta3::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta4::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta5::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta6::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta7::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta8::::::
	cpe:2.3:a:mozilla:firefox:4.0:beta9::::::
	cpe:2.3:a:mozilla:firefox:4.0.1:::::::*

History

No history.

Information

Published : 2011-06-30 16:55

Updated : 2024-02-28 11:41

NVD link : CVE-2011-2367

Mitre link : CVE-2011-2367

CVE.ORG link : CVE-2011-2367

JSON object : View

Products Affected

mozilla

firefox

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2011-2367", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-06-30T16:55:05.177", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html", "source": "cve@mitre.org"}, {"url": "http://www.mozilla.org/security/announce/2011/mfsa2011-26.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=656752", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14302", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict read operations, which allows remote attackers to obtain sensitive information from GPU memory associated with an arbitrary process, or cause a denial of service (application crash), via unspecified vectors."}, {"lang": "es", "value": "La implementaci\u00f3n de WebGL en Mozilla Firefox v4.x hasta v4.0.1 no restringe bien las operaciones de lectura, lo que permite a atacantes remotos obtener informaci\u00f3n sensible de la memoria de la GPU asociada con un proceso arbitrario o causar una denegaci\u00f3n de servicio (ca\u00edda de aplicaci\u00f3n ), a trav\u00e9s de vectores no especificados."}], "lastModified": "2017-09-19T01:33:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C69962C4-FA56-47F2-82A4-DFF4C19DAF3A"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7BC1684-3634-4585-B7E6-8C8777E1DA0D"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A490D040-EF74-45C2-89ED-D88ADD222712"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CDA17D1-CD93-401E-860C-7C3291FEEB7E"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F72FDE3-54E0-48E4-9015-1B8A36DB1EC3"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4062C901-3828-415B-A6C3-EDD0E7B20C0E"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC0D8730-7034-4AD6-9B05-F8BAFB0145EF"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "857AFB05-F0C1-4061-9680-9561D68C908F"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC37EBAF-C979-4ACC-ACA9-BDC2AECCB0D7"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80801CD8-EEAF-4BC4-9085-DCCC6CF73076"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAF4C78A-5093-4871-AF69-A8E8FD7E1AAE"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "560AD4C7-89D2-4323-BBCC-A89EEB6832CB"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B389CBC-4F6C-4C17-A87B-A6DD92703A10"}, {"criteria": "cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDFBA043-91BC-4FB5-A34D-FCE1A9C65A88"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}