VYPR
Unrated severityNVD Advisory· Published Sep 29, 2011· Updated Apr 29, 2026

CVE-2011-3000

CVE-2011-3000

Description

Mozilla Firefox, Thunderbird, and SeaMonkey improperly handle multiple HTTP headers, enabling response splitting attacks via CRLF injection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Mozilla Firefox, Thunderbird, and SeaMonkey improperly handle multiple HTTP headers, enabling response splitting attacks via CRLF injection.

Vulnerability

Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses containing multiple Location, Content-Length, or Content-Disposition headers. When multiple headers with different values are present, the browser uses the second occurrence, which may be attacker-controlled, differing from other browsers that use the first [2]. This behavior can be exploited via CRLF injection against a vulnerable server.

Exploitation

An attacker must first exploit a CRLF injection vulnerability on a target server to inject additional HTTP headers into the server's response. By injecting a second Location header with a malicious value, the attacker can cause Mozilla browsers to redirect users to an attacker-controlled site. The same technique applies to Content-Length or Content-Disposition headers, enabling further manipulation of the response [2][3]. No user interaction beyond visiting the affected server is required.

Impact

Successful exploitation allows HTTP response splitting attacks, potentially leading to cache poisoning, cross-site scripting (XSS), or open redirect. The attacker can control the user's navigation or inject malicious content into the response stream, depending on the server's vulnerability and the application context [2].

Mitigation

Fixed in Firefox 3.6.23 and 7, Thunderbird 3.1.15 and 7, and SeaMonkey 2.4, released on September 27, 2011 [2]. Users should update to these or later versions. No workarounds are documented; if unable to patch, minimize exposure to untrusted servers. This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

213
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 37 more
    • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <=3.6.22
    • cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.15:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.16:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.17:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.18:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.19:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.20:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.21:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:3.6.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:firefox:6.0:*:*:*:*:*:*:*
    • (no CPE)range: before 3.6.23 and 4.x through 6
  • cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*+ 70 more
    • cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*range: <=2.3.3
    • cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0.99:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0:*:alpha:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0:*:beta:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.0:*:dev:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.18:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.19:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.5:1.1.10:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.5.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0a1:*:pre:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0a1pre:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.1:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.1:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:seamonkey:2.1:alpha3:*:*:*:*:*:*
    • (no CPE)range: before 2.4
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 100 more
    • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <=6.0.2
    • cpe:2.3:a:mozilla:thunderbird:0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.5:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:1.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.18:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.19:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.20:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.21:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.22:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.23:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0_.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0_.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0_.14:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0_.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0_.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0_.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0_8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:2.0_.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:3.1.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:5.0:*:*:*:*:*:*:*
    • (no CPE)range: before 7.0
  • osv-coords3 versions
    < 128.5.1-1.1+ 2 more
    • (no CPE)range: < 128.5.1-1.1
    • (no CPE)range: < 50.1.0-1.1
    • (no CPE)range: < 45.5.1-1.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.