CVE-2012-1959
published 2012-07-18CVE-2012-1959: Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11…
PriorityP423medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
2.46%
82.6th percentile
Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of objects, which allows remote attackers to bypass intended XBL access restrictions via crafted content.
Affected
95 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | seamonkey | <= 2.10 | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_ubuntu9.3CRITICAL
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-942g-57h9-xx24: Mozilla Firefox 4
ghsa_unreviewed·2022-05-14
CVE-2012-1959 [MEDIUM] GHSA-942g-57h9-xx24: Mozilla Firefox 4
Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of objects, which allows remote attackers to bypass intended XBL access restrictions via crafted content.
Ubuntu
ubufox update
vendor_ubuntu·2012-07-18·CVSS 9.3
[CRITICAL] ubufox update
Title: ubufox update
Summary: This update provides compatible ubufox packages for the latest Firefox.
USN-1509-1 fixed vulnerabilities in Firefox. This update provides an updated
ubufox package for use with the lastest Firefox.
Original advisory details:
Benoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith,
Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered
memory safety issues affecting Firefox. If the user were tricked into opening a
specially crafted page, an attacker could possibly exploit these to cause a
denial of service via application crash, or potentially execute code with the
privileges of the user invoking Firefox. (CVE-2012-1948, CVE-2012-1949)
Mario Gomes discovered that the address bar may be incorrectly updated.
Drag-
Red Hat
Mozilla: Same-compartment Security Wrappers can be bypassed (MFSA 2012-49)
vendor_redhat·2012-07-17·CVSS 5.0
CVE-2012-1959 [MEDIUM] Mozilla: Same-compartment Security Wrappers can be bypassed (MFSA 2012-49)
Mozilla: Same-compartment Security Wrappers can be bypassed (MFSA 2012-49)
Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of objects, which allows remote attackers to bypass intended XBL access restrictions via crafted content.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2012-07-17·CVSS 9.3
CVE-2012-1948 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Benoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith,
Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered
memory safety issues affecting Firefox. If the user were tricked into opening a
specially crafted page, an attacker could possibly exploit these to cause a
denial of service via application crash, or potentially execute code with the
privileges of the user invoking Firefox. (CVE-2012-1948, CVE-2012-1949)
Mario Gomes discovered that the address bar may be incorrectly updated.
Drag-and-drop events in the address bar may cause the address of the previous
site to be displayed while a new page is loaded. An attacker could exploit this
to conduct phishi
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2012-07-17·CVSS 9.3
CVE-2012-1948 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Benoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith,
Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered
memory safety issues affecting Thunderbird. If the user were tricked into
opening a specially crafted page, an attacker could possibly exploit these to
cause a denial of service via application crash, or potentially execute code
with the privileges of the user invoking Thunderbird. (CVE-2012-1948,
CVE-2012-1949)
Abhishek Arya discovered four memory safety issues affecting Thunderbird. If
the user were tricked into opening a specially crafted page, an attacker could
possibly exploit these to cause a denial of service via application crash,
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-07/msg00016.htmlhttp://osvdb.org/84002http://rhn.redhat.com/errata/RHSA-2012-1088.htmlhttp://secunia.com/advisories/49965http://secunia.com/advisories/49968http://secunia.com/advisories/49972http://secunia.com/advisories/49977http://secunia.com/advisories/49979http://secunia.com/advisories/49992http://secunia.com/advisories/49993http://secunia.com/advisories/49994http://www.mozilla.org/security/announce/2012/mfsa2012-49.htmlhttp://www.securityfocus.com/bid/54576http://www.securitytracker.com/id?1027256http://www.securitytracker.com/id?1027257http://www.securitytracker.com/id?1027258http://www.ubuntu.com/usn/USN-1509-1http://www.ubuntu.com/usn/USN-1509-2http://www.ubuntu.com/usn/USN-1510-1https://bugzilla.mozilla.org/show_bug.cgi?id=737559https://bugzilla.mozilla.org/show_bug.cgi?id=754044https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16920http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-07/msg00016.htmlhttp://osvdb.org/84002http://rhn.redhat.com/errata/RHSA-2012-1088.htmlhttp://secunia.com/advisories/49965http://secunia.com/advisories/49968http://secunia.com/advisories/49972http://secunia.com/advisories/49977http://secunia.com/advisories/49979http://secunia.com/advisories/49992http://secunia.com/advisories/49993http://secunia.com/advisories/49994http://www.mozilla.org/security/announce/2012/mfsa2012-49.htmlhttp://www.securityfocus.com/bid/54576http://www.securitytracker.com/id?1027256http://www.securitytracker.com/id?1027257http://www.securitytracker.com/id?1027258http://www.ubuntu.com/usn/USN-1509-1http://www.ubuntu.com/usn/USN-1509-2http://www.ubuntu.com/usn/USN-1510-1https://bugzilla.mozilla.org/show_bug.cgi?id=737559https://bugzilla.mozilla.org/show_bug.cgi?id=754044https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16920
2012-07-18
Published