QwikSec

Security Database

CVE

CWE

Training

CVE-2011-2986

Published: Aug 18, 2011

Modified: Aug 6, 2024

PUBLISHED

Description

Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products, when the Direct2D (aka D2D) API is used on Windows, allows remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://www.mozilla.org/security/announce/2011/mfsa2011-31.html

x_refsource_CONFIRM

oval:org.mitre.oval:def:14497

vdb-entry

signature

x_refsource_OVAL

https://bugzilla.mozilla.org/show_bug.cgi?id=655836

x_refsource_CONFIRM

http://www.mozilla.org/security/announce/2011/mfsa2011-33.html

x_refsource_CONFIRM

SUSE-SA:2011:037

vendor-advisory

x_refsource_SUSE

third-party-advisory

x_refsource_SECUNIA

http://www.mozilla.org/security/announce/2011/mfsa2011-29.html

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.