CVE-2012-0464
Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.00%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to execute arbitrary code via vectors involving an empty argument to the array.join function in conjunction with the triggering of garbage collection.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 4.00% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- mozilla/firefox · mozilla/thunderbird · mozilla/thunderbird esr · mozilla/seamonkey
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
- http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.htmlThird Party Advisory
- http://pwn2own.zerodayinitiative.com/status.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0387.html
- http://rhn.redhat.com/errata/RHSA-2012-0388.html
- http://secunia.com/advisories/48359
- http://secunia.com/advisories/48402
- http://secunia.com/advisories/48414
- http://secunia.com/advisories/48495Third Party Advisory
- http://secunia.com/advisories/48496Third Party Advisory
- http://secunia.com/advisories/48513Third Party Advisory
- http://secunia.com/advisories/48553Third Party Advisory
- http://secunia.com/advisories/48561Third Party Advisory
- http://secunia.com/advisories/48624Third Party Advisory
- http://secunia.com/advisories/48629Third Party Advisory
- http://secunia.com/advisories/48823Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:031
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:032
- http://www.mozilla.org/security/announce/2012/mfsa2012-19.htmlVendor Advisory
- http://www.securityfocus.com/bid/52465
- http://www.securitytracker.com/id?1026801
- http://www.securitytracker.com/id?1026803
- http://www.securitytracker.com/id?1026804
- http://www.ubuntu.com/usn/USN-1400-1
- http://www.ubuntu.com/usn/USN-1400-2Third Party Advisory
- http://www.ubuntu.com/usn/USN-1400-3Third Party Advisory
- http://www.ubuntu.com/usn/USN-1400-4Third Party Advisory
- http://www.ubuntu.com/usn/USN-1400-5Third Party Advisory
- http://www.ubuntu.com/usn/USN-1401-1Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.