PRIOn knowledge basePRION:CVE-2012-1967Code injection
7.7 High
AI Score
Confidence
Low
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.035 Low
EPSS
Percentile
91.2%
Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL.
References
lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html
lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html
lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
lists.opensuse.org/opensuse-security-announce/2012-07/msg00016.html
osvdb.org/84013
rhn.redhat.com/errata/RHSA-2012-1088.html
secunia.com/advisories/49963
secunia.com/advisories/49964
secunia.com/advisories/49965
secunia.com/advisories/49968
secunia.com/advisories/49972
secunia.com/advisories/49977
secunia.com/advisories/49979
secunia.com/advisories/49992
secunia.com/advisories/49993
secunia.com/advisories/49994
www.debian.org/security/2012/dsa-2514
www.debian.org/security/2012/dsa-2528
www.mozilla.org/security/announce/2012/mfsa2012-56.html
www.securityfocus.com/bid/54573
www.securitytracker.com/id?1027256
www.securitytracker.com/id?1027257
www.securitytracker.com/id?1027258
www.ubuntu.com/usn/USN-1509-1
www.ubuntu.com/usn/USN-1509-2
www.ubuntu.com/usn/USN-1510-1
bugzilla.mozilla.org/show_bug.cgi?id=758344
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17025
Related
7.7 High
AI Score
Confidence
Low
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.035 Low
EPSS
Percentile
91.2%