$ cve CVE-2011-2371 JSON

CVE-2011-2371 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 75.7% (pctl 100)

Patch early

A public exploit exists.

Description

Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via vectors involving a long JavaScript Array object.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	75.69% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-189
On CISA KEV	no
Public exploit	yes
Published	2011-06-30
Last modified	2026-06-16

Affected (3)

Vendor	Product
mozilla	firefox
mozilla	seamonkey
mozilla	thunderbird

Public exploits

Source	Title	Date
exploit-db	Mozilla Firefox 4.0.1 - 'Array.reduceRight()' Remote Overflow	2012-02-27
exploit-db	Mozilla Firefox - 'Array.reduceRight()' Integer Overflow (Metasploit) (2)	2011-10-13
exploit-db	Mozilla Firefox - 'Array.reduceRight()' Integer Overflow (1)	2011-10-12

References

→ the Explorer · watch your stack · NVD