CVE-2011-2986

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 5 Thunderbird versions prior to 6 SeaMonkey versions 2.x prior to 2.3

Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data from a different domain by inserting this data into a canvas when the Direct2D API is used on Windows.

Recommendations For Mozilla Firefox versions 4.x through 5, update to a version that does not use the vulnerable Direct2D API or apply a configuration change to restrict the use of this API. For Thunderbird versions prior to 6, update to version 6 or later to resolve the issue. For SeaMonkey versions 2.x prior to 2.3, update to version 2.3 or later to fix the problem.