CVE-2012-1940 — Use After Free in Mozilla Seamonkey

CWE-399CWE-416 — Use After FreeCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents6 sources
Severity
9.3CRITICALNVD
EPSS
3.0%
top 13.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla SeamonkeyMozilla FirefoxMozilla Thunderbird+1 more
Timeline
PublishedJun 5
Latest updateMay 14

Description

Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by changing the size of a container of absolutely positioned elements in a column.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDmozilla/firefox20 versions+19
▶NVDmozilla/thunderbird16 versions+15
▶NVDmozilla/thunderbird_esr5 versions+4
▶NVDmozilla/seamonkey2.9+64

🔴Vulnerability Details

2
GHSA
GHSA-rqvr-fvm8-wh8c: Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox 4↗2022-05-14
▶
CVEList
CVE-2012-1940: Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox 4↗2012-06-05
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2012-06-27
▶
Ubuntu
Firefox vulnerabilities↗2012-06-06
▶
Red Hat
Mozilla: Buffer overflow and use-after-free issues found using Address Sanitizer (MFSA 2012-40)↗2012-06-05
▶

💬Community

1
Bugzilla
CVE-2012-1940 CVE-2012-1941 CVE-2012-1947 Mozilla: Buffer overflow and use-after-free issues found using Address Sanitizer (MFSA 2012-40)↗2012-06-03
▶