Ubuntu.comUB:CVE-2012-5883CVE-2012-5883
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
60.3%
Cross-site scripting (XSS) vulnerability in the Flash component
infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and
4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x
before 4.4rc1, allows remote attackers to inject arbitrary web script or
HTML via vectors related to swfstore.swf, a similar issue to CVE-2010-4209.
Notes
| Author | Note |
|---|---|
| jdstrand | maas uses an embedded copy of yui 3.4.1 in 12.04 and portions of yui3 in 12.10 and higher per upstream, yui3 not affected |
References
www.bugzilla.org/security/3.6.11/
www.yuiblog.com/blog/2012/10/30/security-announcement-swf-vulnerability-in-yui-2/
www.yuiblog.com/blog/2012/11/05/post-mortem-swf-vulnerability-in-yui-2/
yuilibrary.com/support/20121030-vulnerability/
bugzilla.mozilla.org/show_bug.cgi?id=808845
launchpad.net/bugs/cve/CVE-2012-5883
nvd.nist.gov/vuln/detail/CVE-2012-5883
security-tracker.debian.org/tracker/CVE-2012-5883
www.cve.org/CVERecord?id=CVE-2012-5883
Related
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
60.3%