{"id":"CVE-2011-2605","aliases":["DSA-2268-1","DSA-2269-1","DSA-2273-3","EUVD-2011-2588","GHSA-m4ch-8pc5-rpx2","RHSA-2011:0885","RHSA-2011:0886","RHSA-2011:0887","RHSA-2011:0888"],"status":"published","title":"CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk...","description":"CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \\n (newline) character, which is not properly handled in a JavaScript \"document.cookie =\" expression, a different vulnerability than CVE-2011-2374.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01034,"percentile":0.64042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2011-06-30T16:00:00Z","modified":"2026-06-28T10:05:04Z","affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"iceweasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.16-8"}]}],"versions":["3.5.16-4","3.5.16-5","3.5.16-5~bpo50+1","3.5.16-6","3.5.16-6~bpo50+1","3.5.16-7","3.5.16-7~bpo50+1","3.5.16-8~bpo50+1"],"bundled":10},{"source":"osv","ecosystem":"Debian:5.0","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0.19-12"}]}],"versions":["1.9.0.10-1","1.9.0.11-0lenny1","1.9.0.11-1","1.9.0.12-0lenny1","1.9.0.12-1","1.9.0.13-0lenny1","1.9.0.13-1","1.9.0.14-0lenny1","1.9.0.14-1","1.9.0.15-0lenny1","1.9.0.16-1","1.9.0.18-1","1.9.0.19-1","1.9.0.19-11","1.9.0.19-2","1.9.0.19-3","1.9.0.19-4","1.9.0.19-5","1.9.0.19-6","1.9.0.19-7","1.9.0.19-8","1.9.0.19-9","1.9.0.5-1","1.9.0.6-1","1.9.0.7-0lenny1","1.9.0.7-0lenny2","1.9.0.7-1","1.9.0.8-1","1.9.0.9-0lenny2","1.9.0.9-1"],"bundled":10},{"source":"osv","ecosystem":"Debian:6.0","package":"iceape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-6"}]}],"versions":["2.0.11-2","2.0.11-3","2.0.11-4","2.0.11-5"],"bundled":10},{"source":"osv","ecosystem":"Debian:6.0","package":"icedove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.11-1+squeeze3"}]}],"versions":["3.0.11-1","3.0.11-1+squeeze1","3.0.11-1+squeeze2"],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-2.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-2.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-2.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-2.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-2.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-2.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-2.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-2.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-1.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-1.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.18-2.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.18-2.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.18-2.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-1.el6_1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.18-1.el6_1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.18-2.el6_1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.18-2.el6_1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xulrunner-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2.18-2.el6_1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.11-2.el6_1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.11-2.el6_1"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0.12-39.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0.12-39.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0.12-39.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0.12-39.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0.12-39.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0.12-39.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0.12-39.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0.12-39.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0.24-18.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0.24-18.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0.24-18.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0.24-18.el5_6"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"seamonkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"seamonkey-chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"seamonkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"seamonkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"seamonkey-dom-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"seamonkey-js-debugger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"seamonkey-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"seamonkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"seamonkey-chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"seamonkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"seamonkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"seamonkey-dom-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"seamonkey-js-debugger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"seamonkey-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"seamonkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"seamonkey-chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"seamonkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"seamonkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"seamonkey-dom-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"seamonkey-js-debugger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"seamonkey-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"seamonkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"seamonkey-chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"seamonkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"seamonkey-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"seamonkey-dom-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"seamonkey-js-debugger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"seamonkey-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-71.el4"}]}],"bundled":13}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=643051","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14401","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0887.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0885.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.mozilla.org/security/announce/2011/mfsa2011-19.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0888.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0886.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2605","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m4ch-8pc5-rpx2"},{"url":"https://access.redhat.com/errata/RHSA-2011:0885","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.18","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=698313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=714576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=714577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=714580","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=714581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=714583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=714929","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0885.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0083","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0085","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0085","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2363","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2363","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2364","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2365","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2365","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2371","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2371","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2373","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2374","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2374","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2375","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2376","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2376","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2377","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2605","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2605","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:0886","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0886.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:0887","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0887.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:0888","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0888.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-2605","description":"CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \\n (newline) character, which is not properly handled in a JavaScript \"document.cookie =\" expression, a different vulnerability than CVE-2011-2374.","status":"published","published":"2011-06-30T16:00:00Z","modified":"2024-08-06T23:08:23.46Z","updated_at":"2026-11-02T14:35:36.252742Z"}],"euvd":[{"id":"EUVD-2011-2588","description":"CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \\n (newline) character, which is not properly handled in a JavaScript \"document.cookie =\" expression, a different vulnerability than CVE-2011-2374.","status":"published","published":"2011-06-30T16:00:00Z","modified":"2024-08-06T23:08:23Z","updated_at":"2026-11-03T01:39:55.11051Z"}],"ghsa":[{"id":"GHSA-m4ch-8pc5-rpx2","title":"CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk...","description":"CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \\n (newline) character, which is not properly handled in a JavaScript \"document.cookie =\" expression, a different vulnerability than CVE-2011-2374.","status":"published","published":"2022-05-17T01:00:59Z","modified":"2023-02-03T05:02:54Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:53:15.749583Z"}],"nvd":[{"id":"CVE-2011-2605","description":"CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \\n (newline) character, which is not properly handled in a JavaScript \"document.cookie =\" expression, a different vulnerability than CVE-2011-2374.","status":"published","published":"2011-06-30T16:55:05.55Z","modified":"2026-06-16T23:31:38.163Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:09.182398Z"}],"osv":[{"id":"DSA-2268-1","title":"iceweasel - several","status":"published","published":"2011-07-01T00:00:00Z","modified":"2026-03-09T01:20:02.466981Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-2269-1","title":"iceape - several","status":"published","published":"2011-07-01T00:00:00Z","modified":"2026-03-09T01:23:23.309561Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-2273-3","title":"icedove - multiple issues","status":"published","published":"2011-07-06T00:00:00Z","modified":"2026-03-09T01:19:44.569104Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"RHSA-2011:0885","title":"Red Hat Security Advisory: firefox security and bug fix update","status":"published","published":"2024-09-15T19:12:56Z","modified":"2026-06-28T10:05:02Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:0886","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-15T19:13:01Z","modified":"2026-06-28T10:05:03Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:0887","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-15T19:13:06Z","modified":"2026-06-28T10:05:03Z","updated_at":"2026-11-02T15:53:01.003286Z"},{"id":"RHSA-2011:0888","title":"Red Hat Security Advisory: seamonkey security update","status":"published","published":"2024-09-15T19:13:11Z","modified":"2026-06-28T10:05:04Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}