SB2012101003 - Multiple vulnerabilities in Mozilla Firefox ESR

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012101003

SB2012101003 - Multiple vulnerabilities in Mozilla Firefox ESR

Published: October 10, 2012 Updated: August 11, 2020

Security Bulletin ID SB2012101003
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2012-3994)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to conduct cross-site scripting (XSS) attacks via a binary plugin that uses Object.defineProperty to shadow the top object, and leverages the relationship between top.location and the location property.


2) Use-after-free (CVE-ID: CVE-2012-4181)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing unspecified vectors. A remote attackers can execute arbitrary code or cause a denial of service (heap memory corruption).

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Remediation

Install update from vendor's website.

References