Lucene search

Mozilla FoundationMFSA2012-70

HistoryAug 28, 2012 - 12:00 a.m.

Location object security checks bypassed by chrome code — Mozilla

2012-08-2800:00:00

Mozilla Foundation

www.mozilla.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

87.3%

JSON

Mozilla security researcher moz_bug_r_a4 reported that certain security checks in the location object can be bypassed if chrome code is called content in a specific manner. This allowed for the loading of restricted content. This can be combined with other issues to become potentially exploitable.

Affected configurations

Vulners

Node

mozillafirefoxRange<15

mozillafirefox_esrRange<10.0.7

mozillaseamonkeyRange<2.12

mozillathunderbirdRange<15

mozillathunderbird_esrRange<10.0.7

CPENameOperatorVersion
firefoxlt15
firefox esrlt10.0.7
seamonkeylt2.12
thunderbirdlt15
thunderbird esrlt10.0.7

Name	Operator	Version
firefox	lt	15
firefox esr	lt	10.0.7
seamonkey	lt	2.12
thunderbird	lt	15
thunderbird esr	lt	10.0.7

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3978

bugzilla.mozilla.org/show_bug.cgi?id=770429

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

87.3%

JSON

Related for MFSA2012-70