medium4.3
CVE-2012-3985
Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote att…
Impact
Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging initial-origin access after document.domain has been set.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 16.0 |
| Mozilla | Seamonkey | before 2.13 |
| Mozilla | Thunderbird | before 16.0 |
| Canonical | Ubuntu Linux | Versions 10.04, 11.04, 11.10, 12.04 |
| Suse | Linux Enterprise Desktop | Versions 10, 11 |
| Suse | Linux Enterprise Server | Versions 10, 11 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html
- http://osvdb.org/86106
- http://secunia.com/advisories/50856
- http://secunia.com/advisories/50892
- http://secunia.com/advisories/50904
- http://secunia.com/advisories/50935
- http://secunia.com/advisories/50984
- http://www.mozilla.org/security/announce/2012/mfsa2012-76.html
- http://www.ubuntu.com/usn/USN-1611-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=655649
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16108
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html
- http://osvdb.org/86106
- http://secunia.com/advisories/50856
- http://secunia.com/advisories/50892
- http://secunia.com/advisories/50904
- http://secunia.com/advisories/50935
- http://secunia.com/advisories/50984
- http://www.mozilla.org/security/announce/2012/mfsa2012-76.html
- http://www.ubuntu.com/usn/USN-1611-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=655649
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16108