NetSight
IP …
high7.5

CVE-2012-0454

Use-after-free vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.…

Impact

Use-after-free vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 on 32-bit Windows 7 platforms allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving use of the file-open dialog in a child window, related to the IUnknown_QueryService function in the Windows shlwapi.dll library.

Affected products

VendorProductAffected versions
MozillaFirefox
Versions 4.0, 4.0.1, 5.0, 5.0.1, 6.0, 6.0.1
MozillaFirefox Esr
Versions 10.1, 10.2
MozillaThunderbird
Versions 5.0, 6.0, 6.0.1, 6.0.2, 7.0, 7.0.1
MozillaThunderbird Esr
Versions 10.0, 10.0.1, 10.0.2
MozillaSeamonkey
through 2.7
Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4

Weakness classification

CWE-399

References