CVE-2011-3649

Publication date 9 November 2011

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D (aka D2D) API is used on Windows in conjunction with the Azure graphics back-end, allow remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas. NOTE: this issue exists because of a CVE-2011-2986 regression.

Status

Package Ubuntu Release Status
seamonkey 12.04 LTS precise Not in release
11.10 oneiric
Not affected
11.04 natty
Not affected
10.10 maverick Ignored end of life
10.04 LTS lucid
Not affected
8.04 LTS hardy Ignored end of life
firefox 12.04 LTS precise
Not affected
11.10 oneiric
Not affected
11.04 natty
Not affected
10.10 maverick Ignored end of life
10.04 LTS lucid
Not affected
8.04 LTS hardy Ignored end of life
thunderbird 12.04 LTS precise
Not affected
11.10 oneiric
Not affected
11.04 natty
Not affected
10.10 maverick Ignored end of life
10.04 LTS lucid
Not affected
8.04 LTS hardy Ignored end of life
xulrunner-1.9.2 12.04 LTS precise Not in release
11.10 oneiric Not in release
11.04 natty Ignored end of life
10.10 maverick Ignored end of life
10.04 LTS lucid Ignored end of life
8.04 LTS hardy Ignored end of life
xulrunner-2.0 12.04 LTS precise Not in release
11.10 oneiric Not in release
11.04 natty Ignored end of life
10.10 maverick Not in release
10.04 LTS lucid Not in release
8.04 LTS hardy Not in release