CVE-2012-0446

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to inject arbitrary web script or HTML via a (1) web page or (2) Firefox extension, related to improper enforcement of XPConnect security restrictions for frame scripts that call untrusted objects.

References

http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html

http://secunia.com/advisories/49055

http://www.mandriva.com/security/advisories?name=MDVSA-2012:013

http://www.mozilla.org/security/announce/2012/mfsa2012-05.html

http://www.securityfocus.com/bid/51752

https://bugzilla.mozilla.org/show_bug.cgi?id=705651

https://exchange.xforce.ibmcloud.com/vulnerabilities/72837

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14304

Details

Source: MITRE

Published: 2012-02-01

Updated: 2017-09-19

Type: CWE-79

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:5.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:6.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:6.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:6.0.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:7.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:8.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:9.0:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:mozilla:thunderbird:5.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:thunderbird:6.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:thunderbird:6.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:thunderbird:6.0.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:thunderbird:7.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:thunderbird:8.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:thunderbird:9.0:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.18:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:1.1.19:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.12:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.13:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.0.14:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:alpha1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:alpha2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:alpha3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:rc1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.1:rc2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.2:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.2:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.2:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.3:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.3:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.3:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.3.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.3.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.3.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.4:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.4:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.4:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.4:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.4.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.5:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.5:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.5:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.5:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.5:beta4:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.6:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.6:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.6:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.6:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.6:beta4:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.6.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.7:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.7:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.7:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:2.7:beta4:*:*:*:*:*:*

cpe:2.3:a:mozilla:seamonkey:*:beta5:*:*:*:*:*:* versions up to 2.7 (inclusive)

Tenable Plugins

View all (23 total)

IDNameProductFamilySeverity
80788Oracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird6)NessusSolaris Local Security Checks
critical
75951openSUSE Security Update : MozillaFirefox (MozillaFirefox-5750)NessusSuSE Local Security Checks
critical
74833openSUSE Security Update : MozillaFirefox / MozillaThunderbird / chmsee / etc (openSUSE-2012-83)NessusSuSE Local Security Checks
critical
74612openSUSE Security Update : MozillaFirefox / MozillaThunderbird / seamonkey / etc (openSUSE-SU-2012:0567-1)NessusSuSE Local Security Checks
critical
63402GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)NessusGentoo Local Security Checks
critical
58037Ubuntu 11.10 : thunderbird vulnerabilities (USN-1369-1)NessusUbuntu Local Security Checks
critical
801334Mozilla SeaMonkey 2.x < 2.7.0 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801296Mozilla Firefox 9.0 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801248Mozilla Thunderbird 9.0 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
6310SeaMonkey 2.x < 2.7.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
6308Mozilla Thunderbird < 10.0 Multiple VulnerabilitiesNessus Network MonitorSMTP Clients
high
6306Mozilla Firefox < 10.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
57846Ubuntu 10.04 LTS / 10.10 : ubufox and webfav update (USN-1355-3)NessusUbuntu Local Security Checks
critical
57845Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : mozvoikko update (USN-1355-2)NessusUbuntu Local Security Checks
critical
57844Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : firefox vulnerabilities (USN-1355-1)NessusUbuntu Local Security Checks
critical
57838SuSE 11.1 Security Update : MozillaFirefox (SAT Patch Number 5754)NessusSuSE Local Security Checks
critical
57833Mandriva Linux Security Advisory : mozilla (MDVSA-2012:013)NessusMandriva Local Security Checks
critical
57785FreeBSD : mozilla -- multiple vulnerabilities (0a9e2b72-4cb7-11e1-9146-14dae9ebcf89)NessusFreeBSD Local Security Checks
critical
57775Thunderbird 9.x Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
high
57773Firefox < 10.0 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
high
57772SeaMonkey < 2.7.0 Multiple VulnerabilitiesNessusWindows
high
57770Mozilla Thunderbird < 10.0 Multiple VulnerabilitiesNessusWindows
high
57768Firefox < 10.0 Multiple VulnerabilitiesNessusWindows
high