CVE-2012-3972 — Sensitive Information Exposure in Mozilla Firefox

CWE-200 — Sensitive Information ExposureCWE-125 — Out-of-bounds Read7 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
4.5%
top 10.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird+12 more
Timeline
PublishedAug 29
Latest updateMay 13

Description

The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages11 packages

▶NVDmozilla/firefox10.0 — 10.0.7+1
▶NVDmozilla/thunderbird_esr10.0 — 10.0.7
▶NVDmozilla/seamonkey< 2.12

Also affects: Debian Linux 6.0, 7.0, Ubuntu Linux 10.04, 11.04, 11.10, 12.04, Enterprise Linux 6.3

🔴Vulnerability Details

2
GHSA
GHSA-cfqg-h3x9-x87c: The format-number functionality in the XSLT implementation in Mozilla Firefox before 15↗2022-05-13
▶
CVEList
CVE-2012-3972: The format-number functionality in the XSLT implementation in Mozilla Firefox before 15↗2012-08-29
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2012-08-30
▶
Ubuntu
Firefox vulnerabilities↗2012-08-29
▶
Red Hat
Mozilla: Out-of-bounds read in format-number in XSLT (MFSA 2012-65)↗2012-08-28
▶

💬Community

1
Bugzilla
CVE-2012-3972 Mozilla: Out-of-bounds read in format-number in XSLT (MFSA 2012-65)↗2012-08-27
▶
CVE-2012-3972 — Sensitive Information Exposure | cvebase