PRIOn knowledge basePRION:CVE-2012-3972Heap overflow
6.7 Medium
AI Score
Confidence
Low
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
63.8%
The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ubuntu_linux | eq | 11.04 | |
| ubuntu_linux | eq | 11.10 | |
| ubuntu_linux | eq | 12.04 | |
| ubuntu_linux | eq | 10.04 | |
| debian_linux | eq | 7.0 | |
| debian_linux | eq | 6.0 | |
| firefox | lt | 15.0 | |
| firefox_esr | ge | 10.0 | |
| firefox_esr | lt | 10.0.7 | |
| seamonkey | lt | 2.12 |
References
lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
rhn.redhat.com/errata/RHSA-2012-1210.html
rhn.redhat.com/errata/RHSA-2012-1211.html
www.debian.org/security/2012/dsa-2553
www.debian.org/security/2012/dsa-2554
www.debian.org/security/2012/dsa-2556
www.mozilla.org/security/announce/2012/mfsa2012-65.html
www.ubuntu.com/usn/USN-1548-1
www.ubuntu.com/usn/USN-1548-2
www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
bugzilla.mozilla.org/show_bug.cgi?id=746855
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16234
Related
6.7 Medium
AI Score
Confidence
Low
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
63.8%