CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
73.2%
Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.
Vendor | Product | Version | CPE |
---|---|---|---|
mozilla | firefox | * | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
mozilla | firefox_esr | * | cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
mozilla | seamonkey | * | cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* |
mozilla | thunderbird | * | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
mozilla | thunderbird_esr | * | cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:* |
opensuse | opensuse | 11.4 | cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* |
opensuse | opensuse | 12.1 | cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:* |
opensuse | opensuse | 12.2 | cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* |
suse | linux_enterprise_desktop | 10 | cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:* |
suse | linux_enterprise_desktop | 11 | cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:* |
lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html
lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.html
rhn.redhat.com/errata/RHSA-2012-1407.html
rhn.redhat.com/errata/RHSA-2012-1413.html
secunia.com/advisories/51121
secunia.com/advisories/51123
secunia.com/advisories/51127
secunia.com/advisories/51144
secunia.com/advisories/51146
secunia.com/advisories/51147
secunia.com/advisories/51165
secunia.com/advisories/55318
www.mozilla.org/security/announce/2012/mfsa2012-90.html
www.securityfocus.com/bid/56301
www.ubuntu.com/usn/USN-1620-1
www.ubuntu.com/usn/USN-1620-2
bugzilla.mozilla.org/show_bug.cgi?id=800666
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16918