CVE-2011-2988: Mozilla Firefox

High severity, CVSS 10.0. EPSS: 5.5% chance of exploitation in the next 30 days.

Buffer overflow in an unspecified string class in the WebGL shader implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long source-code block for a shader.

Affected products

• Mozilla Firefox: version 4.0 only; version 4.0.1 only; version 5.0 only
• Mozilla Seamonkey: version 2.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.4 only; version 2.0.5 only; …
• Mozilla Thunderbird: up to and including 5.0

Published 2011-08-18. Last modified 2026-06-16.