CVE-2012-3972

2012-08-2910:56:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2012-3972

mozilla firefox

thunderbird

xslt

information security

buffer over-read

nvd

8.3 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

64.3%

JSON

The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.

CPENameOperatorVersion
mozilla:firefoxmozilla firefoxlt15.0
mozilla:seamonkeymozilla seamonkeylt2.12
mozilla:thunderbirdmozilla thunderbirdlt15.0
mozilla:firefox_esrmozilla firefox esrlt10.0.7
mozilla:thunderbird_esrmozilla thunderbird esrlt10.0.7
suse:linux_enterprise_desktopsuse linux enterprise desktopeq11
opensuse:opensuseopensuseeq12.2
suse:linux_enterprise_serversuse linux enterprise servereq11
suse:linux_enterprise_software_development_kitsuse linux enterprise software development kiteq11
suse:linux_enterprise_desktopsuse linux enterprise desktopeq10

CPE	Name	Operator	Version
mozilla:firefox	mozilla firefox	lt	15.0
mozilla:seamonkey	mozilla seamonkey	lt	2.12
mozilla:thunderbird	mozilla thunderbird	lt	15.0
mozilla:firefox_esr	mozilla firefox esr	lt	10.0.7
mozilla:thunderbird_esr	mozilla thunderbird esr	lt	10.0.7
suse:linux_enterprise_desktop	suse linux enterprise desktop	eq	11
opensuse:opensuse	opensuse	eq	12.2
suse:linux_enterprise_server	suse linux enterprise server	eq	11
suse:linux_enterprise_software_development_kit	suse linux enterprise software development kit	eq	11
suse:linux_enterprise_desktop	suse linux enterprise desktop	eq	10