9.3

CVE-2012-3967

Exploit

The WebGL implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 on Linux, when a large number of sampler uniforms are used, does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted web site.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version < 15.0
   Linux ≫ Linux Kernel
Mozilla ≫ Firefox Version >= 10.0 < 10.0.7
   Linux ≫ Linux Kernel
Mozilla ≫ Seamonkey Version < 2.12
   Linux ≫ Linux Kernel
Mozilla ≫ Thunderbird Version < 15.0
   Linux ≫ Linux Kernel
Mozilla ≫ Thunderbird Esr Version >= 10.0 < 10.0.7
   Linux ≫ Linux Kernel
Opensuse ≫ Opensuse Version12.2
Suse ≫ Linux Enterprise Desktop Version10 Updatesp4
Suse ≫ Linux Enterprise Desktop Version11 Updatesp2
Suse ≫ Linux Enterprise Server Version10 Updatesp4
Suse ≫ Linux Enterprise Server Version11 Updatesp2
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatformvmware
Redhat ≫ Enterprise Linux Eus Version6.3
Canonical ≫ Ubuntu Linux Version10.04 SwEdition-
Canonical ≫ Ubuntu Linux Version11.04
Canonical ≫ Ubuntu Linux Version11.10
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.59% 0.667
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://www.securityfocus.com/bid/55277
Third Party Advisory
VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=777028
Patch
Vendor Advisory
Exploit
Issue Tracking