CVE-2011-2362
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not...
5.0 MediumFix available
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.
Exploit likelihood
1.78%Down 0.9 points since Feb 4, 2022
What each source reports
NVD Score used
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.
- Record
CVE-2011-2362- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.
- Record
CVE-2011-2362- Updated
- 2026-11-02
EUVDEUVD-2011-2351 No score
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.
- Record
EUVD-2011-2351- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-94rr-f3c7-jj57 No score
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not...
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.
- Record
GHSA-94rr-f3c7-jj57- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceweaselDebian:6.0 |
before 3.5.16-8, plus listed versions 3.5.16-43.5.16-53.5.16-5~bpo50+13.5.16-63.5.16-6~bpo50+13.5.16-73.5.16-7~bpo50+13.5.16-8~bpo50+1 |
3.5.16-8 |
xulrunnerDebian:5.0 |
before 1.9.0.19-12, plus listed versions 1.9.0.10-11.9.0.11-0lenny11.9.0.11-11.9.0.12-0lenny11.9.0.12-1 Show 25 moreShow less1.9.0.13-0lenny11.9.0.13-11.9.0.14-0lenny11.9.0.14-11.9.0.15-0lenny11.9.0.16-11.9.0.18-11.9.0.19-11.9.0.19-111.9.0.19-21.9.0.19-31.9.0.19-41.9.0.19-51.9.0.19-61.9.0.19-71.9.0.19-81.9.0.19-91.9.0.5-11.9.0.6-11.9.0.7-0lenny11.9.0.7-0lenny21.9.0.7-11.9.0.8-11.9.0.9-0lenny21.9.0.9-1 |
1.9.0.19-12 |
iceapeDebian:6.0 |
before 2.0.11-6, plus listed versions 2.0.11-22.0.11-32.0.11-42.0.11-5 |
2.0.11-6 |
icedoveDebian:6.0 |
before 3.0.11-1+squeeze3, plus listed versions 3.0.11-13.0.11-1+squeeze13.0.11-1+squeeze2 |
3.0.11-1+squeeze3 |
firefoxRed Hat:enterprise_linux:4::as |
before 0:3.6.18-2.el4 | 0:3.6.18-2.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::as |
before 0:3.6.18-2.el4 | 0:3.6.18-2.el4 |
firefoxRed Hat:enterprise_linux:4::desktop |
before 0:3.6.18-2.el4 | 0:3.6.18-2.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:3.6.18-2.el4 | 0:3.6.18-2.el4 |
firefoxRed Hat:enterprise_linux:4::es |
before 0:3.6.18-2.el4 | 0:3.6.18-2.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::es |
before 0:3.6.18-2.el4 | 0:3.6.18-2.el4 |
Show 55 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:4::ws |
before 0:3.6.18-2.el4 | 0:3.6.18-2.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:3.6.18-2.el4 | 0:3.6.18-2.el4 |
firefoxRed Hat:enterprise_linux:5::server |
before 0:3.6.18-1.el5_6 | 0:3.6.18-1.el5_6 |
firefox-debuginfoRed Hat:enterprise_linux:5::server |
before 0:3.6.18-1.el5_6 | 0:3.6.18-1.el5_6 |
xulrunnerRed Hat:enterprise_linux:5::server |
before 0:1.9.2.18-2.el5_6 | 0:1.9.2.18-2.el5_6 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.9.2.18-2.el5_6 | 0:1.9.2.18-2.el5_6 |
xulrunner-develRed Hat:enterprise_linux:5::server |
before 0:1.9.2.18-2.el5_6 | 0:1.9.2.18-2.el5_6 |
firefoxRed Hat:enterprise_linux:6::server |
before 0:3.6.18-1.el6_1 | 0:3.6.18-1.el6_1 |
firefox-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.6.18-1.el6_1 | 0:3.6.18-1.el6_1 |
xulrunnerRed Hat:enterprise_linux:6::server |
before 0:1.9.2.18-2.el6_1 | 0:1.9.2.18-2.el6_1 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.9.2.18-2.el6_1 | 0:1.9.2.18-2.el6_1 |
xulrunner-develRed Hat:enterprise_linux:6::server |
before 0:1.9.2.18-2.el6_1 | 0:1.9.2.18-2.el6_1 |
thunderbirdRed Hat:enterprise_linux:6::server |
before 0:3.1.11-2.el6_1 | 0:3.1.11-2.el6_1 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.1.11-2.el6_1 | 0:3.1.11-2.el6_1 |
thunderbirdRed Hat:enterprise_linux:4::as |
before 0:1.5.0.12-39.el4 | 0:1.5.0.12-39.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.5.0.12-39.el4 | 0:1.5.0.12-39.el4 |
thunderbirdRed Hat:enterprise_linux:4::desktop |
before 0:1.5.0.12-39.el4 | 0:1.5.0.12-39.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.5.0.12-39.el4 | 0:1.5.0.12-39.el4 |
thunderbirdRed Hat:enterprise_linux:4::es |
before 0:1.5.0.12-39.el4 | 0:1.5.0.12-39.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.5.0.12-39.el4 | 0:1.5.0.12-39.el4 |
thunderbirdRed Hat:enterprise_linux:4::ws |
before 0:1.5.0.12-39.el4 | 0:1.5.0.12-39.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.5.0.12-39.el4 | 0:1.5.0.12-39.el4 |
thunderbirdRed Hat:enterprise_linux:5::client |
before 0:2.0.0.24-18.el5_6 | 0:2.0.0.24-18.el5_6 |
thunderbird-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.0.0.24-18.el5_6 | 0:2.0.0.24-18.el5_6 |
thunderbirdRed Hat:rhel_productivity:5 |
before 0:2.0.0.24-18.el5_6 | 0:2.0.0.24-18.el5_6 |
thunderbird-debuginfoRed Hat:rhel_productivity:5 |
before 0:2.0.0.24-18.el5_6 | 0:2.0.0.24-18.el5_6 |
seamonkeyRed Hat:enterprise_linux:4::as |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::as |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-develRed Hat:enterprise_linux:4::as |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::as |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::as |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::as |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkeyRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-develRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkeyRed Hat:enterprise_linux:4::es |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::es |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-develRed Hat:enterprise_linux:4::es |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::es |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::es |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::es |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkeyRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-develRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-71.el4 | 0:1.0.9-71.el4 |
MozillaThunderbirdopenSUSE:Tumbleweed |
before 45.5.1-1.1 | 45.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2362 is a medium vulnerability (CVSS 5.0) in Mozilla Firefox, published June 30, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.78%, the 78th percentile. Fixed in iceweasel 3.5.16-8.
References
mandriva.com/security/advisories?name=MDVSA-2011:111
secunia.com/advisories/45002
support.avaya.com/css/P8/documents/100145333
ubuntu.com/usn/USN-1149-1
mozilla.org/security/announce/2011/mfsa2011-24.html
Show 194 moreShow less
redhat.com/support/errata/RHSA-2011-0887.html
bugzilla.mozilla.org/show_bug.cgi?id=616264
debian.org/security/2011/dsa-2268
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13693
lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
nvd.nist.gov/vuln/detail/CVE-2011-2362
github.com/advisories/GHSA-94rr-f3c7-jj57
access.redhat.com/errata/RHSA-2011:0885
bugzilla.redhat.com/show_bug.cgi?id=698313
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0885.json
cve.org/CVERecord?id=CVE-2011-0083
suse.com/security/cve/CVE-2009-0040
This page doesn't list everything
Left out here: 433 references. The JSON record has them.