Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object.
CPE | Name | Operator | Version |
---|---|---|---|
ubuntu_linux | eq | 11.04 | |
ubuntu_linux | eq | 11.10 | |
ubuntu_linux | eq | 12.10 | |
ubuntu_linux | eq | 12.04 | |
ubuntu_linux | eq | 10.04 | |
firefox | lt | 16.0.2 | |
firefox_esr | ge | 10.0 | |
firefox_esr | lt | 10.0.10 | |
seamonkey | lt | 2.13.2 | |
thunderbird | lt | 16.0.2 |
lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html
lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.html
rhn.redhat.com/errata/RHSA-2012-1407.html
rhn.redhat.com/errata/RHSA-2012-1413.html
secunia.com/advisories/51121
secunia.com/advisories/51123
secunia.com/advisories/51127
secunia.com/advisories/51144
secunia.com/advisories/51146
secunia.com/advisories/51147
secunia.com/advisories/51165
secunia.com/advisories/55318
www.mozilla.org/security/announce/2012/mfsa2012-90.html
www.securityfocus.com/bid/56306
www.ubuntu.com/usn/USN-1620-1
www.ubuntu.com/usn/USN-1620-2
bugzilla.mozilla.org/show_bug.cgi?id=802557
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16962