CVE-2012-3991
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.08%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 3.08% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- mozilla/firefox · mozilla/thunderbird esr · mozilla/thunderbird · mozilla/seamonkey · canonical/ubuntu linux · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux workstation · suse/linux enterprise desktop · suse/linux enterprise sdk · suse/linux enterprise server
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.htmlMailing List, Third Party Advisory
- http://osvdb.org/86098Broken Link
- http://rhn.redhat.com/errata/RHSA-2012-1351.htmlThird Party Advisory
- http://secunia.com/advisories/50856Third Party Advisory
- http://secunia.com/advisories/50892Third Party Advisory
- http://secunia.com/advisories/50904Third Party Advisory
- http://secunia.com/advisories/50935Third Party Advisory
- http://secunia.com/advisories/50936Third Party Advisory
- http://secunia.com/advisories/50984Third Party Advisory
- http://secunia.com/advisories/51181Third Party Advisory
- http://secunia.com/advisories/55318Third Party Advisory
- http://www.debian.org/security/2012/dsa-2565Third Party Advisory
- http://www.debian.org/security/2012/dsa-2569Third Party Advisory
- http://www.debian.org/security/2012/dsa-2572Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:163Third Party Advisory
- http://www.mozilla.org/security/announce/2012/mfsa2012-81.htmlVendor Advisory
- http://www.securityfocus.com/bid/55930Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1611-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=783260Issue Tracking, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16646Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.htmlMailing List, Third Party Advisory
- http://osvdb.org/86098Broken Link
- http://rhn.redhat.com/errata/RHSA-2012-1351.htmlThird Party Advisory
- http://secunia.com/advisories/50856Third Party Advisory
- http://secunia.com/advisories/50892Third Party Advisory
- http://secunia.com/advisories/50904Third Party Advisory
- http://secunia.com/advisories/50935Third Party Advisory
- http://secunia.com/advisories/50936Third Party Advisory
- http://secunia.com/advisories/50984Third Party Advisory
- http://secunia.com/advisories/51181Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.