MitreCVELIST:CVE-2012-4195CVE-2012-4195
The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior.
References
lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html
lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.html
rhn.redhat.com/errata/RHSA-2012-1407.html
rhn.redhat.com/errata/RHSA-2012-1413.html
secunia.com/advisories/51121
secunia.com/advisories/51123
secunia.com/advisories/51127
secunia.com/advisories/51144
secunia.com/advisories/51146
secunia.com/advisories/51147
secunia.com/advisories/51165
secunia.com/advisories/55318
www.mozilla.org/security/announce/2012/mfsa2012-90.html
www.securityfocus.com/bid/56302
www.ubuntu.com/usn/USN-1620-1
www.ubuntu.com/usn/USN-1620-2
bugzilla.mozilla.org/show_bug.cgi?id=793121
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16856
Related
