4.3

CVE-2012-4194

Exploit

Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.

Data is provided by the National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version < 16.0.2
Mozilla ≫ Firefox Version >= 10.0 < 10.0.10
Mozilla ≫ Seamonkey Version < 2.13.2
Mozilla ≫ Thunderbird Version < 16.0.2
Mozilla ≫ Thunderbird Esr Version >= 10.0 < 10.0.10
Opensuse ≫ Opensuse Version11.4
Opensuse ≫ Opensuse Version12.1
Opensuse ≫ Opensuse Version12.2
Suse ≫ Linux Enterprise Desktop Version10 Updatesp4
Suse ≫ Linux Enterprise Desktop Version11 Updatesp2
Suse ≫ Linux Enterprise Server Version10 Updatesp4
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatform-
Suse ≫ Linux Enterprise Server Version11 Updatesp2 SwPlatformvmware
Canonical ≫ Ubuntu Linux Version10.04 SwEdition-
Canonical ≫ Ubuntu Linux Version11.04
Canonical ≫ Ubuntu Linux Version11.10
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version12.10
Redhat ≫ Enterprise Linux Eus Version6.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.36% 0.792
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://www.securityfocus.com/bid/56301
Third Party Advisory
VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=800666
Patch
Vendor Advisory
Exploit
Issue Tracking