{"id":"CVE-2011-2378","aliases":["DSA-2295-1","DSA-2296-1","DSA-2297-1","EUVD-2011-2367","GHSA-q8vw-h86h-vfj9","RHSA-2011:1164","RHSA-2011:1166"],"status":"published","title":"The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12,...","description":"The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x, and possibly other products does not properly handle DOM objects, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a \"dangling pointer.\"","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.05608,"percentile":0.92963,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2011-08-17T00:00:00Z","modified":"2026-06-28T10:05:08Z","affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"iceape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-7"}]}],"versions":["2.0.11-2","2.0.11-3","2.0.11-4","2.0.11-5","2.0.11-6"],"bundled":6},{"source":"osv","ecosystem":"Debian:6.0","package":"iceweasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.16-9"}]}],"versions":["3.5.16-4","3.5.16-5","3.5.16-5~bpo50+1","3.5.16-6","3.5.16-6~bpo50+1","3.5.16-7","3.5.16-7~bpo50+1","3.5.16-8","3.5.16-8~bpo50+1"],"bundled":6},{"source":"osv","ecosystem":"Debian:5.0","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0.19-13"}]}],"versions":["1.9.0.10-1","1.9.0.11-0lenny1","1.9.0.11-1","1.9.0.12-0lenny1","1.9.0.12-1","1.9.0.13-0lenny1","1.9.0.13-1","1.9.0.14-0lenny1","1.9.0.14-1","1.9.0.15-0lenny1","1.9.0.16-1","1.9.0.18-1","1.9.0.19-1","1.9.0.19-11","1.9.0.19-12","1.9.0.19-2","1.9.0.19-3","1.9.0.19-4","1.9.0.19-5","1.9.0.19-6","1.9.0.19-7","1.9.0.19-8","1.9.0.19-9","1.9.0.5-1","1.9.0.6-1","1.9.0.7-0lenny1","1.9.0.7-0lenny2","1.9.0.7-1","1.9.0.8-1","1.9.0.9-0lenny2","1.9.0.9-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:6.0","package":"icedove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1+squeeze4"}]}],"versions":["3.0.11-1","3.0.11-1+squeeze1","3.0.11-1+squeeze2","3.0.11-1+squeeze3"],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el6_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.20-2.el6_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el6_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el6_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.20-2.el6_1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.12-1.el6_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.12-1.el6_1"}]}],"bundled":3}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"seamonkey"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:127","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://www.mozilla.org/security/announce/2011/mfsa2011-30.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=648065","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2011/dsa-2297","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.debian.org/security/2011/dsa-2296","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1166.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1164.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://www.debian.org/security/2011/dsa-2295","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14163","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2378","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q8vw-h86h-vfj9"},{"url":"https://access.redhat.com/errata/RHSA-2011:1164","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.20","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=730523","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1164.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0084","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2378","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2981","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2981","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2982","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2982","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2983","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2983","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2983","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2984","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2984","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:1166","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1166.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-2378","description":"The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x, and possibly other products does not properly handle DOM objects, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a \"dangling pointer.\"","status":"published","published":"2011-08-18T18:00:00Z","modified":"2024-08-06T23:00:33.549Z","updated_at":"2026-11-02T14:35:36.603688Z"}],"euvd":[{"id":"EUVD-2011-2367","description":"The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x, and possibly other products does not properly handle DOM objects, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a \"dangling pointer.\"","status":"published","published":"2011-08-18T18:00:00Z","modified":"2024-08-06T23:00:33Z","updated_at":"2026-11-03T01:55:52.768318Z"}],"ghsa":[{"id":"GHSA-q8vw-h86h-vfj9","title":"The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12,...","description":"The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x, and possibly other products does not properly handle DOM objects, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a \"dangling pointer.\"","status":"published","published":"2022-05-17T01:01:04Z","modified":"2023-02-03T05:03:03Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:53:17.178427Z"}],"nvd":[{"id":"CVE-2011-2378","description":"The appendChild function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x, and possibly other products does not properly handle DOM objects, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to dereferencing of a \"dangling pointer.\"","status":"published","published":"2011-08-18T18:55:01.477Z","modified":"2026-06-16T23:31:13.587Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:09.988332Z"}],"osv":[{"id":"DSA-2295-1","title":"iceape - several","status":"published","published":"2011-08-17T00:00:00Z","modified":"2026-03-09T01:23:13.57801Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-2296-1","title":"iceweasel - several","status":"published","published":"2011-08-17T00:00:00Z","modified":"2026-03-09T01:17:45.027341Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-2297-1","title":"icedove - several","status":"published","published":"2011-08-21T00:00:00Z","modified":"2026-03-09T01:23:15.27303Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"RHSA-2011:1164","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-13T07:07:27Z","modified":"2026-06-28T10:05:07Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:1166","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-13T07:07:36Z","modified":"2026-06-28T10:05:08Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}