CVE-2012-4201

2012-11-2112:55:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2012-4201

mozilla firefox

thunderbird

seamonkey

evalinsandbox

cross-site scripting

xss

remote code execution

nvd

security vulnerability

8.1 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

70.7%

JSON

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on.

CPENameOperatorVersion
mozilla:firefoxmozilla firefoxlt17.0
mozilla:seamonkeymozilla seamonkeylt2.14
mozilla:thunderbirdmozilla thunderbirdlt17.0
mozilla:thunderbird_esrmozilla thunderbird esrlt10.0.11
mozilla:firefox_esrmozilla firefox esrlt10.0.11
suse:linux_enterprise_serversuse linux enterprise servereq10
suse:linux_enterprise_serversuse linux enterprise servereq11
suse:linux_enterprise_desktopsuse linux enterprise desktopeq11
opensuse:opensuseopensuseeq11.4
opensuse:opensuseopensuseeq12.2

CPE	Name	Operator	Version
mozilla:firefox	mozilla firefox	lt	17.0
mozilla:seamonkey	mozilla seamonkey	lt	2.14
mozilla:thunderbird	mozilla thunderbird	lt	17.0
mozilla:thunderbird_esr	mozilla thunderbird esr	lt	10.0.11
mozilla:firefox_esr	mozilla firefox esr	lt	10.0.11
suse:linux_enterprise_server	suse linux enterprise server	eq	10
suse:linux_enterprise_server	suse linux enterprise server	eq	11
suse:linux_enterprise_desktop	suse linux enterprise desktop	eq	11
opensuse:opensuse	opensuse	eq	11.4
opensuse:opensuse	opensuse	eq	12.2