CVE-2012-1947 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Seamonkey

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-416 — Use After Free9 documents7 sources
Severity
9.3CRITICALNVD
EPSS
6.8%
top 8.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla SeamonkeyMozilla FirefoxMozilla Thunderbird+1 more
Timeline
PublishedJun 5
Latest updateMay 14

Description

Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code via vectors that trigger a character-set conversion failure.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDmozilla/firefox20 versions+19
▶NVDmozilla/thunderbird16 versions+15
▶NVDmozilla/thunderbird_esr5 versions+4
▶NVDmozilla/seamonkey2.9+64

🔴Vulnerability Details

2
GHSA
GHSA-22c8-wr9r-qr3j: Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4↗2022-05-14
▶
CVEList
CVE-2012-1947: Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4↗2012-06-05
▶

📋Vendor Advisories

4
Ubuntu
Thunderbird vulnerabilities↗2012-06-27
▶
Ubuntu
Firefox regressions↗2012-06-20
▶
Ubuntu
Firefox vulnerabilities↗2012-06-06
▶
Red Hat
Mozilla: Buffer overflow and use-after-free issues found using Address Sanitizer (MFSA 2012-40)↗2012-06-05
▶

📄Research Papers

1
arXiv
A Systematically Empirical Evaluation of Vulnerability Discovery Models: a Study on Browsers' Vulnerabilities↗2013-06-11
▶

💬Community

1
Bugzilla
CVE-2012-1940 CVE-2012-1941 CVE-2012-1947 Mozilla: Buffer overflow and use-after-free issues found using Address Sanitizer (MFSA 2012-40)↗2012-06-03
▶
CVE-2012-1947 — Mozilla Seamonkey vulnerability | cvebase