<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2011-3658" target="_blank">CVE</a>)</em> : The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.

Upgrade to Firefox and Thunderbird to version 9.0 or higher, and SeaMonkey to version 2.6 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1026445 1026446 1026447
• OVAL ID: 14664
• Exploit Database: 18847
• CVE ID: 2011-3658 (see also: NVD)
• Secunia Advisory ID: 47302 47334 47460 47504 47761 47958 48495 48553 48823 49055 51766
• ISS X-Force ID: 71910
• Related OSVDB ID: 77951 77952 77954 77955 77956
• Metasploit ID: 77953
• Mail List Post: http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html
  http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html
  http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-updates/2012-02/msg00010.html
  http://lists.opensuse.org/opensuse-updates/2012-04/msg00066.html
  http://www.gentoo.org/security/en/glsa/glsa-201301-01.xml
  http://www.mozilla.org/security/announce/2011/mfsa2011-55.html
  http://www.ubuntu.com/usn/usn-1306-1/
  http://www.ubuntu.com/usn/usn-1306-2/
  http://www.ubuntu.com/usn/usn-1343-1
  http://www.ubuntu.com/usn/USN-1401-1
  http://www.ubuntu.com/usn/usn-1401-2/
  https://bugzilla.mozilla.org/show_bug.cgi?id=708186 [ Auth Req'd ]
  https://hermes.opensuse.org/messages/13154636
  https://hermes.opensuse.org/messages/13155295
• Packet Storm: http://packetstormsecurity.org/files/111706/Zero-Day-Initiative-Advisory-12-056.html
• Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDVSA-2011:192
  http://www.zerodayinitiative.com/advisories/ZDI-12-056
• Vendor Specific Advisory URL: https://hermes.opensuse.org/messages/14081825

Unknown or Incomplete