CVE-2011-0084

The SVGTextElement.getCharNumAtPosition function in Mozilla Firefox before 3.6.20, and 4.x through 5; Thunderbird 3.x before 3.1.12 and other versions before 6; SeaMonkey 2.x before 2.3; and possibly other products does not properly handle SVG text, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer."

• CWE-94

• https://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
• https://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html
• https://www.debian.org/security/2011/dsa-2295
• https://www.debian.org/security/2011/dsa-2296
• https://www.debian.org/security/2011/dsa-2297
• https://www.mandriva.com/security/advisories?name=MDVSA-2011:127
• https://www.mozilla.org/security/announce/2011/mfsa2011-29.htmlVendor Advisory
• https://www.mozilla.org/security/announce/2011/mfsa2011-30.htmlVendor Advisory
• https://www.mozilla.org/security/announce/2011/mfsa2011-31.html
• https://www.mozilla.org/security/announce/2011/mfsa2011-33.html
• https://www.redhat.com/support/errata/RHSA-2011-1164.htmlVendor Advisory
• https://www.redhat.com/support/errata/RHSA-2011-1166.htmlVendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=648094
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14502
• https://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
• https://lists.opensuse.org/opensuse-security-announce/2011-08/msg00027.html
• https://www.debian.org/security/2011/dsa-2295
• https://www.debian.org/security/2011/dsa-2296
• https://www.debian.org/security/2011/dsa-2297
• https://www.mandriva.com/security/advisories?name=MDVSA-2011:127
• https://www.mozilla.org/security/announce/2011/mfsa2011-29.htmlVendor Advisory
• https://www.mozilla.org/security/announce/2011/mfsa2011-30.htmlVendor Advisory
• https://www.mozilla.org/security/announce/2011/mfsa2011-31.html
• https://www.mozilla.org/security/announce/2011/mfsa2011-33.html
• https://www.redhat.com/support/errata/RHSA-2011-1164.htmlVendor Advisory
• https://www.redhat.com/support/errata/RHSA-2011-1166.htmlVendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=648094
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14502

Published

Aug 18, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-0078Unspecified vulnerability in the browser engine in Mozilla F…
• CVE-2011-0079Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2011-0080Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2011-0081Unspecified vulnerability in the browser engine in Mozilla F…
• CVE-2011-0082The X.509 certificate validation functionality in Mozilla Fi…
• CVE-2011-0083Use-after-free vulnerability in the nsSVGPathSegList::Replac…
• CVE-2011-0085Use-after-free vulnerability in the nsXULCommandDispatcher f…
• CVE-2011-0086win32k.sys in the kernel-mode drivers in Microsoft Windows X…
• CVE-2011-0087win32k.sys in the kernel-mode drivers in Microsoft Windows X…
• CVE-2011-0088win32k.sys in the kernel-mode drivers in Microsoft Windows X…
• CVE-2011-0089win32k.sys in the kernel-mode drivers in Microsoft Windows X…
• CVE-2011-0090win32k.sys in the kernel-mode drivers in Microsoft Windows X…