CVE-2011-3658

Exp

The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.

Published: 2011-12-20 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2011-3658 is rated High Exploit Risk (79.4/100): CVSS High severity, with high exploitation likelihood (EPSS 69.88%, 99th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2011-3658

EDB-ID Source Kind Published Link
18847 exploit_db edb 2012-05-09 Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2011-3658

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-23 70.19% 69.88% -0.31%
2 2026-06-15 75.88% 70.19% -5.69%
3 2025-03-17 75.88%

Full EPSS history (15 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2011-3658

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 2.0 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
10.0 6.4 [email protected]

Weakness enumeration for CVE-2011-3658

OS Trackers for CVE-2011-3658

vendor priority summary link
gentoo high CVE-2011-3658: 1 GLSA(s) (201301-01), 14 atom(s) (dev-libs/nss, mail-client/mozilla-thunderbird, …); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2011-3658
redhat critical https://access.redhat.com/security/cve/CVE-2011-3658
suse high CVE-2011-3658 severity important: SUSE including 66 source package names (MozillaFirefox-10.0-0.3.2, MozillaFirefox-140.2.0-160000.1.2, …), 82 product×package rows across 30 product lines (SUSE Linux Enterprise Desktop 12, SUSE Linux Enterprise Desktop 12 SP1, … (30 product lines)): Fixed 82. https://www.suse.com/security/cve/CVE-2011-3658/
ubuntu low CVE-2011-3658 low priority: Ubuntu including 5 source packages (firefox, seamonkey, thunderbird, xulrunner-1.9.2, xulrunner-2.0), 50 status rows across 10 suites (hardy, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, upstream): DNE 17, released 11, ignored 10, not-affected 8, needs-triage 4. https://ubuntu.com/security/CVE-2011-3658

Affected software / configurations for CVE-2011-3658

Vendor Product Version Raw CPE
mozilla firefox 8.0 cpe:2.3:a:mozilla:firefox:8.0:*:*:*:*:*:*:*
mozilla seamonkey 2.5 cpe:2.3:a:mozilla:seamonkey:2.5:*:*:*:*:*:*:*
mozilla thunderbird 8.0 cpe:2.3:a:mozilla:thunderbird:8.0:*:*:*:*:*:*:*

References for CVE-2011-3658

URL Tags
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00009.html
http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
http://osvdb.org/77953
http://secunia.com/advisories/47302
http://secunia.com/advisories/47334
http://secunia.com/advisories/48495
http://secunia.com/advisories/48553
http://secunia.com/advisories/48823
http://secunia.com/advisories/49055
http://www.mandriva.com/security/advisories?name=MDVSA-2011:192
http://www.mandriva.com/security/advisories?name=MDVSA-2012:031
http://www.mozilla.org/security/announce/2011/mfsa2011-55.html Vendor Advisory
http://www.securitytracker.com/id?1026445
http://www.securitytracker.com/id?1026446
http://www.securitytracker.com/id?1026447
http://www.ubuntu.com/usn/USN-1401-1
https://bugzilla.mozilla.org/show_bug.cgi?id=708186
https://exchange.xforce.ibmcloud.com/vulnerabilities/71910
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14664
cvelogic Threat Intelligence