MitreCVELIST:CVE-2012-0458CVE-2012-0458
Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict setting the home page through the dragging of a URL to the home button, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a javascript: URL that is later interpreted in the about:sessionrestore context.
References
lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
rhn.redhat.com/errata/RHSA-2012-0387.html
rhn.redhat.com/errata/RHSA-2012-0388.html
secunia.com/advisories/48359
secunia.com/advisories/48402
secunia.com/advisories/48414
secunia.com/advisories/48495
secunia.com/advisories/48496
secunia.com/advisories/48513
secunia.com/advisories/48553
secunia.com/advisories/48561
secunia.com/advisories/48624
secunia.com/advisories/48629
secunia.com/advisories/48823
secunia.com/advisories/48920
www.debian.org/security/2012/dsa-2433
www.debian.org/security/2012/dsa-2458
www.mandriva.com/security/advisories?name=MDVSA-2012:031
www.mandriva.com/security/advisories?name=MDVSA-2012:032
www.mozilla.org/security/announce/2012/mfsa2012-16.html
www.securityfocus.com/bid/52460
www.securitytracker.com/id?1026801
www.securitytracker.com/id?1026803
www.securitytracker.com/id?1026804
www.ubuntu.com/usn/USN-1400-1
www.ubuntu.com/usn/USN-1400-2
www.ubuntu.com/usn/USN-1400-3
www.ubuntu.com/usn/USN-1400-4
www.ubuntu.com/usn/USN-1400-5
www.ubuntu.com/usn/USN-1401-1
bugzilla.mozilla.org/show_bug.cgi?id=718203
bugzilla.mozilla.org/show_bug.cgi?id=719994
bugzilla.mozilla.org/show_bug.cgi?id=723808
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15122
Related
