$ cve CVE-2011-0065 JSON

CVE-2011-0065 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 73.8% (pctl 99)

Patch early

A public exploit exists.

Description

Use-after-free vulnerability in Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, allows remote attackers to execute arbitrary code via vectors related to OBJECT's mChannel.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	73.84% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-399
On CISA KEV	no
Public exploit	yes
Published	2011-05-07
Last modified	2026-06-16

Affected (2)

Vendor	Product
mozilla	firefox
mozilla	seamonkey

Public exploits

Source	Title	Date
exploit-db	Mozilla Firefox 3.6.16 (OSX) - mChannel Use-After-Free (Metasploit) (2)	2012-01-17
exploit-db	Mozilla Firefox 3.6.16 (Windows 7) - mChannel Object Use-After-Free	2011-08-16
exploit-db	Mozilla Firefox 3.6.16 (Windows) - mChannel Use-After-Free (Metasploit) (1)	2011-08-10
exploit-db	Mozilla Firefox 3.6.16 - OBJECT mChannel Remote Code Execution (DEP Bypass) (Metasploit)	2011-08-05

References

→ the Explorer · watch your stack · NVD