MitreCVELIST:CVE-2012-0455CVE-2012-0455
Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a “DragAndDropJacking” issue.
References
lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
rhn.redhat.com/errata/RHSA-2012-0387.html
rhn.redhat.com/errata/RHSA-2012-0388.html
secunia.com/advisories/48359
secunia.com/advisories/48402
secunia.com/advisories/48414
secunia.com/advisories/48495
secunia.com/advisories/48496
secunia.com/advisories/48513
secunia.com/advisories/48553
secunia.com/advisories/48561
secunia.com/advisories/48624
secunia.com/advisories/48629
secunia.com/advisories/48823
secunia.com/advisories/48920
www.debian.org/security/2012/dsa-2433
www.debian.org/security/2012/dsa-2458
www.mandriva.com/security/advisories?name=MDVSA-2012:031
www.mandriva.com/security/advisories?name=MDVSA-2012:032
www.mozilla.org/security/announce/2012/mfsa2012-13.html
www.securityfocus.com/bid/52458
www.securitytracker.com/id?1026801
www.securitytracker.com/id?1026803
www.securitytracker.com/id?1026804
www.ubuntu.com/usn/USN-1400-1
www.ubuntu.com/usn/USN-1400-2
www.ubuntu.com/usn/USN-1400-3
www.ubuntu.com/usn/USN-1400-4
www.ubuntu.com/usn/USN-1400-5
www.ubuntu.com/usn/USN-1401-1
bugzilla.mozilla.org/show_bug.cgi?id=704354
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14829
Related
