CVE-2011-0066
Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and...
10.0 High
Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mObserverList.
Exploit likelihood
4.91%Down 3.3 points since Feb 4, 2022
What each source reports
NVD Score used
Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mObserverList.
- Record
CVE-2011-0066- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mObserverList.
- Record
CVE-2011-0066- Updated
- 2026-11-02
EUVDEUVD-2011-0092 No score
Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mObserverList.
- Record
EUVD-2011-0092- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7c8x-pggq-qrgr No score
Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and...
Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mObserverList.
- Record
GHSA-7c8x-pggq-qrgr- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceapeDebian:6.0 From an advisory covering 14 CVEs |
before 2.0.11-5, plus listed versions 2.0.11-22.0.11-32.0.11-4 |
2.0.11-5 |
iceweaselDebian:6.0 From an advisory covering 14 CVEs |
before 3.5.16-7, plus listed versions 3.5.16-43.5.16-53.5.16-5~bpo50+13.5.16-63.5.16-6~bpo50+13.5.16-7~bpo50+1 |
3.5.16-7 |
icedoveDebian:6.0 From an advisory covering 14 CVEs |
before 3.0.11-1+squeeze2, plus listed versions 3.0.11-13.0.11-1+squeeze1 |
3.0.11-1+squeeze2 |
firefoxRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs |
before 0:3.6.17-2.el4 | 0:3.6.17-2.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 15 CVEs |
before 0:3.6.17-2.el4 | 0:3.6.17-2.el4 |
firefoxRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs |
before 0:3.6.17-2.el4 | 0:3.6.17-2.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 15 CVEs |
before 0:3.6.17-2.el4 | 0:3.6.17-2.el4 |
firefoxRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs |
before 0:3.6.17-2.el4 | 0:3.6.17-2.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 15 CVEs |
before 0:3.6.17-2.el4 | 0:3.6.17-2.el4 |
firefoxRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs |
before 0:3.6.17-2.el4 | 0:3.6.17-2.el4 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefox-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 15 CVEs |
before 0:3.6.17-2.el4 | 0:3.6.17-2.el4 |
firefoxRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 0:3.6.17-1.el5_6 | 0:3.6.17-1.el5_6 |
firefox-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 0:3.6.17-1.el5_6 | 0:3.6.17-1.el5_6 |
xulrunnerRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 0:1.9.2.17-3.el5_6 | 0:1.9.2.17-3.el5_6 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 0:1.9.2.17-3.el5_6 | 0:1.9.2.17-3.el5_6 |
xulrunner-develRed Hat:enterprise_linux:5::server From an advisory covering 15 CVEs |
before 0:1.9.2.17-3.el5_6 | 0:1.9.2.17-3.el5_6 |
xulrunnerRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunner-develRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
firefoxRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 0:3.6.17-1.el6_0 | 0:3.6.17-1.el6_0 |
firefox-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 15 CVEs |
before 0:3.6.17-1.el6_0 | 0:3.6.17-1.el6_0 |
firefoxRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 0:3.6.17-1.el6_0 | 0:3.6.17-1.el6_0 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 0:3.6.17-1.el6_0 | 0:3.6.17-1.el6_0 |
xulrunnerRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunner-develRed Hat:enterprise_linux:6::computenode From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunnerRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunner-develRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
firefoxRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 0:3.6.17-1.el6_0 | 0:3.6.17-1.el6_0 |
firefox-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 15 CVEs |
before 0:3.6.17-1.el6_0 | 0:3.6.17-1.el6_0 |
xulrunnerRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
xulrunner-develRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 0:1.9.2.17-4.el6_0 | 0:1.9.2.17-4.el6_0 |
firefoxRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 0:3.6.17-1.el6_0 | 0:3.6.17-1.el6_0 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 15 CVEs |
before 0:3.6.17-1.el6_0 | 0:3.6.17-1.el6_0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0066 is a high vulnerability (CVSS 10.0) in Mozilla Firefox, published April 30, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.91%, the 92nd percentile. No source names a fixed version.
References
debian.org/security/2011/dsa-2228
mandriva.com/security/advisories?name=MDVSA-2011:079
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13970
mozilla.org/security/announce/2011/mfsa2011-13.html
Show 67 moreShow less
bugzilla.mozilla.org/show_bug.cgi?id=634983
downloads.avaya.com/css/P8/documents/100144158
nvd.nist.gov/vuln/detail/CVE-2011-0066
github.com/advisories/GHSA-7c8x-pggq-qrgr
access.redhat.com/errata/RHSA-2011:0471
bugzilla.redhat.com/show_bug.cgi?id=684386
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0471.json
cve.org/CVERecord?id=CVE-2011-0065