CVE-2012-1957 — Cross-site Scripting in Mozilla Seamonkey

CWE-79 — Cross-site Scripting7 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
1.0%
top 23.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla SeamonkeyMozilla FirefoxMozilla Thunderbird+1 more
Timeline
PublishedJul 18
Latest updateMay 14

Description

An unspecified parser-utility class in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly handle EMBED elements within description elements in RSS feeds, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a feed.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages4 packages

▶NVDmozilla/firefox22 versions+21
▶NVDmozilla/thunderbird17 versions+16
▶NVDmozilla/thunderbird_esr6 versions+5
▶NVDmozilla/seamonkey2.10+49

🔴Vulnerability Details

2
GHSA
GHSA-f778-wp6q-3cwj: An unspecified parser-utility class in Mozilla Firefox 4↗2022-05-14
▶
CVEList
CVE-2012-1957: An unspecified parser-utility class in Mozilla Firefox 4↗2012-07-18
▶

📋Vendor Advisories

3
Ubuntu
Firefox vulnerabilities↗2012-07-17
▶
Red Hat
Mozilla: Improper filtering of javascript in HTML feed-view (MFSA 2012-47)↗2012-07-17
▶
Ubuntu
Thunderbird vulnerabilities↗2012-07-17
▶

💬Community

1
Bugzilla
CVE-2012-1957 Mozilla: Improper filtering of javascript in HTML feed-view (MFSA 2012-47)↗2012-07-14
▶
CVE-2012-1957 — Cross-site Scripting in Mozilla | cvebase