Lucene search

Mozilla FoundationMFSA2012-29

HistoryApr 24, 2012 - 12:00 a.m.

Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues — Mozilla

2012-04-2400:00:00

Mozilla Foundation

www.mozilla.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

66.2%

JSON

Security researcher Masato Kinugawa found that during the decoding of ISO-2022-KR and ISO-2022-CN character sets, characters near 1024 bytes are treated incorrectly, either doubling or deleting bytes. On certain pages it might be possible for an attacker to pad the output of the page such that these errors fall in the right place to affect the structure of the page, allowing for cross-site script (XSS) injection.

Affected configurations

Vulners

Node

mozillafirefoxRange<12

mozillafirefox_esrRange<10.0.4

mozillaseamonkeyRange<2.9

mozillathunderbirdRange<12

mozillathunderbird_esrRange<10.0.4

CPENameOperatorVersion
firefoxlt12
firefox esrlt10.0.4
seamonkeylt2.9
thunderbirdlt12
thunderbird esrlt10.0.4

Name	Operator	Version
firefox	lt	12
firefox esr	lt	10.0.4
seamonkey	lt	2.9
thunderbird	lt	12
thunderbird esr	lt	10.0.4

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0477

bugzilla.mozilla.org/show_bug.cgi?id=718573

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

66.2%

JSON

Related for MFSA2012-29