CVE-2012-0442
published 2012-02-01CVE-2012-0442: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0…
PriorityP335critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
4.60%
90.6th percentile
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| mozilla | firefox | < 3.6.26 | 3.6.26 |
| mozilla | firefox | >= 4.0 < 10.0 | 10.0 |
| mozilla | seamonkey | < 2.7 | 2.7 |
| mozilla | thunderbird | < 3.1.18 | 3.1.18 |
| mozilla | thunderbird | >= 5.0 < 10.0 | 10.0 |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_ubuntu10.0CRITICAL
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2012-02-17·CVSS 9.3
CVE-2012-0452 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Nicolas Gregoire and Aki Helin discovered that when processing a malformed
embedded XSLT stylesheet, Thunderbird can crash due to memory corruption.
If the user were tricked into opening a specially crafted page, an attacker
could exploit this to cause a denial of service via application crash, or
potentially execute code with the privileges of the user invoking
Thunderbird. (CVE-2012-0449)
It was discovered that memory corruption could occur during the decoding of
Ogg Vorbis files. If the user were tricked into opening a specially crafted
file, an attacker could exploit this to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invokin
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2012-02-08·CVSS 9.3
CVE-2012-0442 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Jesse Ruderman and Bob Clary discovered memory safety issues affecting
Thunderbird. If the user were tricked into opening a specially crafted
page, an attacker could exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Thunderbird. (CVE-2012-0442)
It was discovered that Thunderbird did not properly handle node removal in
the DOM. If the user were tricked into opening a specially crafted page, an
attacker could exploit this to cause a denial of service via application
crash, or potentially execute code with the privileges of the user invoking
Thunderbird. (CVE-2011-3659)
It was discovered that memory corruption c
Ubuntu
Xulrunnner vulnerabilities
vendor_ubuntu·2012-02-08·CVSS 9.3
CVE-2012-0442 [CRITICAL] Xulrunnner vulnerabilities
Title: Xulrunnner vulnerabilities
Summary: Several security issues were fixed in Xulrunner.
Jesse Ruderman and Bob Clary discovered memory safety issues affecting the
Gecko Browser engine. If the user were tricked into opening a specially
crafted page, an attacker could exploit these to cause a denial of service
via application crash, or potentially execute code with the privileges of
the user invoking Xulrunner. (CVE-2012-0442)
It was discovered that the Gecko Browser engine did not properly handle
node removal in the DOM. If the user were tricked into opening a specially
crafted page, an attacker could exploit this to cause a denial of service
via application crash, or potentially execute code with the privileges of
the user invoking Xulrunner. (CVE-2011-3659)
It was discovered that
Ubuntu
Mozvoikko update
vendor_ubuntu·2012-02-03·CVSS 10.0
CVE-2012-0450 [CRITICAL] Mozvoikko update
Title: Mozvoikko update
Summary: This update provides compatible Mozvoikko packages for the latest Firefox.
USN-1355-1 fixed vulnerabilities in Firefox. This update provides an
updated Mozvoikko package for use with the latest Firefox.
Original advisory details:
It was discovered that if a user chose to export their Firefox Sync key
the "Firefox Recovery Key.html" file is saved with incorrect permissions,
making the file contents potentially readable by other users.
(CVE-2012-0450)
Nicolas Gregoire and Aki Helin discovered that when processing a malformed
embedded XSLT stylesheet, Firefox can crash due to memory corruption. If
the user were tricked into opening a specially crafted page, an attacker
could exploit this to cause a denial of service via application crash, or
potentially e
Ubuntu
ubufox and webfav update
vendor_ubuntu·2012-02-03·CVSS 10.0
[CRITICAL] ubufox and webfav update
Title: ubufox and webfav update
Summary: This update provides compatible ubufox and webfav packages for the latest
Firefox.
USN-1355-1 fixed vulnerabilities in Firefox. This update provides updated
ubufox and webfav packages for use with the latest Firefox.
Original advisory details:
It was discovered that if a user chose to export their Firefox Sync key
the "Firefox Recovery Key.html" file is saved with incorrect permissions,
making the file contents potentially readable by other users.
(CVE-2012-0450)
Nicolas Gregoire and Aki Helin discovered that when processing a malformed
embedded XSLT stylesheet, Firefox can crash due to memory corruption. If
the user were tricked into opening a specially crafted page, an attacker
could exploit this to cause a denial of service via application c
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2012-02-03·CVSS 10.0
CVE-2012-0450 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
It was discovered that if a user chose to export their Firefox Sync key
the "Firefox Recovery Key.html" file is saved with incorrect permissions,
making the file contents potentially readable by other users.
(CVE-2012-0450)
Nicolas Gregoire and Aki Helin discovered that when processing a malformed
embedded XSLT stylesheet, Firefox can crash due to memory corruption. If
the user were tricked into opening a specially crafted page, an attacker
could exploit this to cause a denial of service via application crash, or
potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-0449)
It was discovered that memory corruption could occur during the decoding of
Ogg Vorbis files. If th
Red Hat
Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)
vendor_redhat·2012-01-31·CVSS 9.3
CVE-2012-0442 [CRITICAL] Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)
Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
GHSA
GHSA-mgq7-pc7j-7mm4: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3
ghsa_unreviewed·2022-05-04
CVE-2012-0442 [HIGH] GHSA-mgq7-pc7j-7mm4: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.htmlhttp://www.debian.org/security/2012/dsa-2400http://www.debian.org/security/2012/dsa-2402http://www.debian.org/security/2012/dsa-2406http://www.mandriva.com/security/advisories?name=MDVSA-2012:013http://www.mozilla.org/security/announce/2012/mfsa2012-01.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=693399https://bugzilla.mozilla.org/show_bug.cgi?id=705347https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14678http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.htmlhttp://www.debian.org/security/2012/dsa-2400http://www.debian.org/security/2012/dsa-2402http://www.debian.org/security/2012/dsa-2406http://www.mandriva.com/security/advisories?name=MDVSA-2012:013http://www.mozilla.org/security/announce/2012/mfsa2012-01.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=693399https://bugzilla.mozilla.org/show_bug.cgi?id=705347https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14678
2012-02-01
Published