CVE-2011-3640

Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."

• CWE-426

• http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.htmlExploit, Third Party Advisory
• http://code.google.com/p/chromium/issues/detail?id=97426Exploit, Issue Tracking, Patch, Vendor Advisory
• http://securityreason.com/securityalert/8483Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=641052Issue Tracking, Patch, Third Party Advisory
• https://hermes.opensuse.org/messages/13154861Broken Link
• https://hermes.opensuse.org/messages/13155432Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414Third Party Advisory
• http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-planting.htmlExploit, Third Party Advisory
• http://code.google.com/p/chromium/issues/detail?id=97426Exploit, Issue Tracking, Patch, Vendor Advisory
• http://securityreason.com/securityalert/8483Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=641052Issue Tracking, Patch, Third Party Advisory
• https://hermes.opensuse.org/messages/13154861Broken Link
• https://hermes.opensuse.org/messages/13155432Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13414Third Party Advisory

Published

Oct 28, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-3634methods/https.cc in apt before 0.8.11 accepts connections wh…
• CVE-2011-3635Cross-site scripting (XSS) vulnerability in the theme_adium_…
• CVE-2011-3636Cross-site request forgery (CSRF) vulnerability in the manag…
• CVE-2011-3637The m_stop function in fs/proc/task_mmu.c in the Linux kerne…5.5
• CVE-2011-3638fs/ext4/extents.c in the Linux kernel before 3.0 does not ma…
• CVE-2011-3639The mod_proxy module in the Apache HTTP Server 2.0.x through…
• CVE-2011-3642Cross-site scripting (XSS) vulnerability in Flowplayer Flash…9.6
• CVE-2011-3645Newgen OmniDocs allows remote attackers to bypass intended a…
• CVE-2011-3646phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows r…
• CVE-2011-3647The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and T…
• CVE-2011-3648Cross-site scripting (XSS) vulnerability in Mozilla Firefox …
• CVE-2011-3649Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D (…