CVE-2011-3658: Mozilla Firefox

High severity, CVSS 7.5. EPSS: 69.6% chance of exploitation in the next 30 days.

The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.

Affected products

• Mozilla Firefox: version 8.0 only
• Mozilla Seamonkey: version 2.5 only
• Mozilla Thunderbird: version 8.0 only

Published 2011-12-21. Last modified 2026-06-16.