CVE-2011-2370
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall...
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.
- Record
CVE-2011-2370- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.
- Record
CVE-2011-2370- Updated
- 2026-11-02
EUVDEUVD-2011-2359 No score
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.
- Record
EUVD-2011-2359- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q4f3-7m9m-fpqf No score
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall...
Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors.
- Record
GHSA-q4f3-7m9m-fpqf- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxopenSUSE:Tumbleweed |
before 50.1.0-1.1 | 50.1.0-1.1 |
firefox-esropenSUSE:Tumbleweed |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2370 is a medium vulnerability (CVSS 5.0) in Mozilla Firefox, published June 30, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in MozillaFirefox 50.1.0-1.1.
References
mozilla.org/security/announce/2011/mfsa2011-28.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14278
bugzilla.mozilla.org/show_bug.cgi?id=645699
lists.opensuse.org/opensuse-security-announce/2011-07/msg00001.html
nvd.nist.gov/vuln/detail/CVE-2011-2370
github.com/advisories/GHSA-q4f3-7m9m-fpqf
Show 194 moreShow less
suse.com/security/cve/CVE-2008-5913
Left out here: 1,892 references. The JSON record has them.