CVE-2012-3986
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote…
Does this matter?
Lower severity and a low EPSS score (2.51%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.51% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- mozilla/firefox · mozilla/thunderbird esr · mozilla/thunderbird · mozilla/seamonkey · canonical/ubuntu linux · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux workstation · debian/debian linux · suse/linux enterprise desktop · suse/linux enterprise sdk · suse/linux enterprise server
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1351.htmlThird Party Advisory
- http://secunia.com/advisories/50856Third Party Advisory
- http://secunia.com/advisories/50892Third Party Advisory
- http://secunia.com/advisories/50904Third Party Advisory
- http://secunia.com/advisories/50935Third Party Advisory
- http://secunia.com/advisories/50936Third Party Advisory
- http://secunia.com/advisories/50984Third Party Advisory
- http://secunia.com/advisories/51181Third Party Advisory
- http://secunia.com/advisories/55318Third Party Advisory
- http://www.debian.org/security/2012/dsa-2565Third Party Advisory
- http://www.debian.org/security/2012/dsa-2569Third Party Advisory
- http://www.debian.org/security/2012/dsa-2572Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:163Third Party Advisory
- http://www.mozilla.org/security/announce/2012/mfsa2012-77.htmlVendor Advisory
- http://www.securityfocus.com/bid/55922Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1611-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=775868Issue Tracking, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16834Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1351.htmlThird Party Advisory
- http://secunia.com/advisories/50856Third Party Advisory
- http://secunia.com/advisories/50892Third Party Advisory
- http://secunia.com/advisories/50904Third Party Advisory
- http://secunia.com/advisories/50935Third Party Advisory
- http://secunia.com/advisories/50936Third Party Advisory
- http://secunia.com/advisories/50984Third Party Advisory
- http://secunia.com/advisories/51181Third Party Advisory
- http://secunia.com/advisories/55318Third Party Advisory
- http://www.debian.org/security/2012/dsa-2565Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.