CVE-2012-0457
Use-after-free vulnerability in the nsSMILTimeValueSpec::ConvertBetweenTimeContainer function in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Use-after-free vulnerability in the nsSMILTimeValueSpec::ConvertBetweenTimeContainer function in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to execute arbitrary code via an SVG animation.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 6.59% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- mozilla/firefox · mozilla/thunderbird · mozilla/thunderbird esr · mozilla/seamonkey
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
- http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0387.html
- http://rhn.redhat.com/errata/RHSA-2012-0388.html
- http://secunia.com/advisories/48359
- http://secunia.com/advisories/48402
- http://secunia.com/advisories/48414
- http://secunia.com/advisories/48495Third Party Advisory
- http://secunia.com/advisories/48496Third Party Advisory
- http://secunia.com/advisories/48513Third Party Advisory
- http://secunia.com/advisories/48553Third Party Advisory
- http://secunia.com/advisories/48561Third Party Advisory
- http://secunia.com/advisories/48624Third Party Advisory
- http://secunia.com/advisories/48629Third Party Advisory
- http://secunia.com/advisories/48823Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:031
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:032
- http://www.mozilla.org/security/announce/2012/mfsa2012-14.htmlThird Party Advisory, Vendor Advisory
- http://www.securitytracker.com/id?1026801
- http://www.securitytracker.com/id?1026803
- http://www.securitytracker.com/id?1026804
- http://www.ubuntu.com/usn/USN-1400-1
- http://www.ubuntu.com/usn/USN-1400-2Third Party Advisory
- http://www.ubuntu.com/usn/USN-1400-3Third Party Advisory
- http://www.ubuntu.com/usn/USN-1400-4Third Party Advisory
- http://www.ubuntu.com/usn/USN-1400-5Third Party Advisory
- http://www.ubuntu.com/usn/USN-1401-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=720103Issue Tracking, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14775Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.