CVE-2011-3640
** DISPUTED ** Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as...
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
Exploit likelihood
What each source reports
NVD Score used
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
- Record
CVE-2011-3640- CVSS 2.0
- 7.1 High
AV:N/AC:H/Au:S/C:C/I:C/A:C - Weakness
- CWE-426
- Updated
- 2026-11-02
CVE List No score
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
- Record
CVE-2011-3640- Updated
- 2026-11-02
EUVDEUVD-2011-3599 No score
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
- Record
EUVD-2011-3599- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-75w4-cpff-gxx5 No score
** DISPUTED ** Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as...
** DISPUTED ** Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
- Record
GHSA-75w4-cpff-gxx5- Weakness
- CWE-426
- Updated
- 2026-11-02
OSV No score
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
- Record
CVE-2011-3640- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-3640 No score
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
- Record
DEBIAN-CVE-2011-3640- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10451-1 No score
libfreebl3-3.26.2-1.1 on GA media
These are all security issues fixed in the libfreebl3-3.26.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10451-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nssDebian:12 |
before 3.13.1.with.ckbi.1.88-1 | 3.13.1.with.ckbi.1.88-1 |
nssDebian:13 |
before 3.13.1.with.ckbi.1.88-1 | 3.13.1.with.ckbi.1.88-1 |
nssDebian:14 |
before 3.13.1.with.ckbi.1.88-1 | 3.13.1.with.ckbi.1.88-1 |
nssDebian:6.0 |
before 3.12.8-1+squeeze4, plus listed versions 3.12.8-13.12.8-1+squeeze13.12.8-1+squeeze1~bpo50+13.12.8-1+squeeze23.12.8-1+squeeze33.12.8-1+squeeze3~bpo50+13.12.8-1+squeeze4~bpo50+1 |
3.12.8-1+squeeze4 |
nssDebian:5.0 |
before 3.12.3.1-0lenny7, plus listed versions 3.12.0-53.12.0-63.12.1-13.12.2.with.ckbi.1.73-13.12.2.with.ckbi.1.73-2 Show 7 moreShow less3.12.3-13.12.3.1-0lenny13.12.3.1-0lenny23.12.3.1-0lenny33.12.3.1-0lenny43.12.3.1-0lenny53.12.3.1-0lenny6 |
3.12.3.1-0lenny7 |
mozilla-nssopenSUSE:Tumbleweed |
before 3.26.2-1.1 | 3.26.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-3640 is a high vulnerability (CVSS 7.1) in Google Chrome, published October 28, 2011. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in nss 3.13.1.with.ckbi.1.88-1.
References
hermes.opensuse.org/messages/13155432
securityreason.com/securityalert/8483
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414
blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.html
code.google.com/p/chromium/issues/detail?id=97426
Show 26 moreShow less
bugzilla.mozilla.org/show_bug.cgi?id=641052
nvd.nist.gov/vuln/detail/CVE-2011-3640
github.com/advisories/GHSA-75w4-cpff-gxx5
security-tracker.debian.org/tracker/CVE-2011-3640
suse.com/security/cve/CVE-2010-3170