Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2012-0458
HistoryMar 14, 2012 - 7:55 p.m.

CVE-2012-0458

2012-03-1419:55:02
CWE-264
[email protected]
web.nvd.nist.gov
47
mozilla firefox
thunderbird
cve-2012-0458
remote code execution
security vulnerability

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.4 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.7%

JSON

Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict setting the home page through the dragging of a URL to the home button, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a javascript: URL that is later interpreted in the about:sessionrestore context.

Affected configurations

NVD
Node
mozillafirefoxRange≤3.6.27
Node
mozillafirefoxRange4.0–10.0
Node
mozillafirefox_esrMatch10.0
OR
mozillafirefox_esrMatch10.0.1
OR
mozillafirefox_esrMatch10.0.2
Node
mozillathunderbirdRange1.0–3.1.19
Node
mozillathunderbirdRange5.0–10.0
Node
mozillathunderbird_esrMatch10.0
OR
mozillathunderbird_esrMatch10.0.1
OR
mozillathunderbird_esrMatch10.0.2
Node
mozillaseamonkeyMatch-
OR
mozillaseamonkeyMatch1.0
OR
mozillaseamonkeyMatch1.0alpha
OR
mozillaseamonkeyMatch1.0beta
OR
mozillaseamonkeyMatch1.0.1
OR
mozillaseamonkeyMatch1.0.2
OR
mozillaseamonkeyMatch1.0.3
OR
mozillaseamonkeyMatch1.0.4
OR
mozillaseamonkeyMatch1.0.5
OR
mozillaseamonkeyMatch1.0.6
OR
mozillaseamonkeyMatch1.0.7
OR
mozillaseamonkeyMatch1.0.8
OR
mozillaseamonkeyMatch1.0.9
OR
mozillaseamonkeyMatch1.1
OR
mozillaseamonkeyMatch1.1alpha
OR
mozillaseamonkeyMatch1.1beta
OR
mozillaseamonkeyMatch1.1.1
OR
mozillaseamonkeyMatch1.1.2
OR
mozillaseamonkeyMatch1.1.3
OR
mozillaseamonkeyMatch1.1.4
OR
mozillaseamonkeyMatch1.1.5
OR
mozillaseamonkeyMatch1.1.6
OR
mozillaseamonkeyMatch1.1.7
OR
mozillaseamonkeyMatch1.1.8
OR
mozillaseamonkeyMatch1.1.9
OR
mozillaseamonkeyMatch1.1.10
OR
mozillaseamonkeyMatch1.1.11
OR
mozillaseamonkeyMatch1.1.12
OR
mozillaseamonkeyMatch1.1.13
OR
mozillaseamonkeyMatch1.1.14
OR
mozillaseamonkeyMatch1.1.15
OR
mozillaseamonkeyMatch1.1.16
OR
mozillaseamonkeyMatch1.1.17
OR
mozillaseamonkeyMatch1.1.18
OR
mozillaseamonkeyMatch1.1.19
OR
mozillaseamonkeyMatch1.5.0.8
OR
mozillaseamonkeyMatch1.5.0.9
OR
mozillaseamonkeyMatch1.5.0.10
OR
mozillaseamonkeyMatch2.0
OR
mozillaseamonkeyMatch2.0alpha_1
OR
mozillaseamonkeyMatch2.0alpha_2
OR
mozillaseamonkeyMatch2.0alpha_3
OR
mozillaseamonkeyMatch2.0beta_1
OR
mozillaseamonkeyMatch2.0beta_2
OR
mozillaseamonkeyMatch2.0rc1
OR
mozillaseamonkeyMatch2.0rc2
OR
mozillaseamonkeyMatch2.0.1
OR
mozillaseamonkeyMatch2.0.2
OR
mozillaseamonkeyMatch2.0.3
OR
mozillaseamonkeyMatch2.0.4
OR
mozillaseamonkeyMatch2.0.5
OR
mozillaseamonkeyMatch2.0.6
OR
mozillaseamonkeyMatch2.0.7
OR
mozillaseamonkeyMatch2.0.8
OR
mozillaseamonkeyMatch2.0.9
OR
mozillaseamonkeyMatch2.0.10
OR
mozillaseamonkeyMatch2.0.11
OR
mozillaseamonkeyMatch2.0.12
OR
mozillaseamonkeyMatch2.0.13
OR
mozillaseamonkeyMatch2.0.14
OR
mozillaseamonkeyMatch2.1
OR
mozillaseamonkeyMatch2.1alpha1
OR
mozillaseamonkeyMatch2.1alpha2
OR
mozillaseamonkeyMatch2.1alpha3
OR
mozillaseamonkeyMatch2.1beta1
OR
mozillaseamonkeyMatch2.1beta2
OR
mozillaseamonkeyMatch2.1beta3
OR
mozillaseamonkeyMatch2.1rc1
OR
mozillaseamonkeyMatch2.1rc2
OR
mozillaseamonkeyMatch2.2
OR
mozillaseamonkeyMatch2.2beta1
OR
mozillaseamonkeyMatch2.2beta2
OR
mozillaseamonkeyMatch2.2beta3
OR
mozillaseamonkeyMatch2.3
OR
mozillaseamonkeyMatch2.3beta1
OR
mozillaseamonkeyMatch2.3beta2
OR
mozillaseamonkeyMatch2.3beta3
OR
mozillaseamonkeyMatch2.3.1
OR
mozillaseamonkeyMatch2.3.2
OR
mozillaseamonkeyMatch2.3.3
OR
mozillaseamonkeyMatch2.4
OR
mozillaseamonkeyMatch2.4beta1
OR
mozillaseamonkeyMatch2.4beta2
OR
mozillaseamonkeyMatch2.4beta3
OR
mozillaseamonkeyMatch2.4.1
OR
mozillaseamonkeyMatch2.5
OR
mozillaseamonkeyMatch2.5beta1
OR
mozillaseamonkeyMatch2.5beta2
OR
mozillaseamonkeyMatch2.5beta3
OR
mozillaseamonkeyMatch2.5beta4
OR
mozillaseamonkeyMatch2.6
OR
mozillaseamonkeyMatch2.6beta1
OR
mozillaseamonkeyMatch2.6beta2
OR
mozillaseamonkeyMatch2.6beta3
OR
mozillaseamonkeyMatch2.6beta4
OR
mozillaseamonkeyMatch2.6.1
OR
mozillaseamonkeyMatch2.7
OR
mozillaseamonkeyMatch2.7beta1
OR
mozillaseamonkeyMatch2.7beta2
OR
mozillaseamonkeyMatch2.7beta3
OR
mozillaseamonkeyMatch2.7beta4
OR
mozillaseamonkeyMatch2.7beta5
OR
mozillaseamonkeyMatch2.7.1
OR
mozillaseamonkeyMatch2.7.2
CPENameOperatorVersion
mozilla:firefoxmozilla firefoxle3.6.27

References

Related

veracode 1
nvd 1
cvelist 1
prion 1
openvas 49
ubuntucve 1
mozilla 1
nessus 46
osv 3
debian 3
ubuntu 7
suse 3
centos 2
oraclelinux 2
redhat 2
freebsd 1
securityvulns 1
gentoo 1
veracode
veracode
Arbitrary Code Execution
2020-04-10 01:07:56
nvd
nvd
CVE-2012-0458
2012-03-14 19:55:02
cvelist
cvelist
CVE-2012-0458
2012-03-14 19:00:00
prion
prion
Code injection
2012-03-14 19:55:00
openvas
openvas
Mozilla Firefox Security Advisory (MFSA2012-16) - Linux
2021-11-16 00:00:00
Debian: Security Advisory (DSA-2437-1)
2012-04-30 00:00:00
Debian Security Advisory DSA 2437-1 (icedove)
2012-04-30 00:00:00
ubuntucve
ubuntucve
CVE-2012-0458
2012-03-14 00:00:00
mozilla
mozilla
Escalation of privilege with Javascript: URL as home page — Mozilla
2012-03-13 00:00:00
nessus
nessus
Debian DSA-2433-1 : iceweasel - several vulnerabilities
2012-03-16 00:00:00
Debian DSA-2437-1 : icedove - several vulnerabilities
2012-03-22 00:00:00
Firefox 3.6.x < 3.6.28 Multiple Vulnerabilities
2012-03-15 00:00:00
osv
osv
iceweasel - several
2012-03-15 00:00:00
icedove - several
2012-03-21 00:00:00
iceape - several
2012-05-13 00:00:00
debian
debian
[SECURITY] [DSA 2437-1] icedove security update
2012-03-21 18:58:26
[SECURITY] [DSA 2433-1] iceweasel security update
2012-03-15 21:42:10
[SECURITY] [DSA 2548-1] iceape security update
2012-04-24 20:56:27
ubuntu
ubuntu
Xulrunner vulnerabilities
2012-03-19 00:00:00
Thunderbird vulnerabilities
2012-03-23 00:00:00
Thunderbird vulnerabilities
2012-03-21 00:00:00
suse
suse
Security update for Mozilla Firefox (critical)
2012-03-29 06:08:20
Security update for Mozilla Firefox (critical)
2012-03-28 21:08:31
Firefox update to 31.1esr (important)
2014-09-09 18:04:16
centos
centos
firefox, xulrunner security update
2012-03-14 11:23:06
thunderbird security update
2012-03-14 11:41:24
oraclelinux
oraclelinux
thunderbird security update
2012-03-14 00:00:00
firefox security and bug fix update
2012-03-14 00:00:00
redhat
redhat
(RHSA-2012:0388) Critical: thunderbird security update
2012-03-14 00:00:00
(RHSA-2012:0387) Critical: firefox security and bug fix update
2012-03-14 00:00:00
freebsd
freebsd
mozilla -- multiple vulnerabilities
2012-03-13 00:00:00
securityvulns
securityvulns
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
2012-03-17 00:00:00
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2013-01-08 00:00:00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

9.4 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.7%

JSON
Related for CVE-2012-0458
veracode1nvd1cvelist1prion1openvas49ubuntucve1mozilla1nessus46osv3debian3ubuntu7suse3centos2oraclelinux2redhat2freebsd1securityvulns1gentoo1