The nsWindow implementation in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 does not check the validity of an instance after event dispatching, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, as demonstrated by Mobile Firefox on Android.

Changes in MozillaThunderbird :

  - update to Thunderbird 11.0 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in mozilla-xulrunner192 :

  - security update to 1.9.2.28 (bnc#750044)

  - MFSA 2011-55/CVE-2011-3658 (bmo#708186) nsSVGValue     out-of-bounds access

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in MozillaFirefox :

  - update to Firefox 11.0 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in seamonkey :

  - update to SeaMonkey 2.8 (bnc#750044)

  - MFSA 2012-13/CVE-2012-0455 (bmo#704354) XSS with Drag     and Drop and Javascript: URL

  - MFSA 2012-14/CVE-2012-0456/CVE-2012-0457 (bmo#711653,     #720103) SVG issues found with Address Sanitizer

  - MFSA 2012-15/CVE-2012-0451 (bmo#717511) XSS with     multiple Content Security Policy headers

  - MFSA 2012-16/CVE-2012-0458 Escalation of privilege with     Javascript: URL as home page

  - MFSA 2012-17/CVE-2012-0459 (bmo#723446) Crash when     accessing keyframe cssText after dynamic modification

  - MFSA 2012-18/CVE-2012-0460 (bmo#727303)     window.fullScreen writeable by untrusted content

  - MFSA 2012-19/CVE-2012-0461/CVE-2012-0462/CVE-2012-0464/     CVE-2012-0463 Miscellaneous memory safety hazards

Changes in chmsee :

  - Update to version 1.99.08

Changes in mozilla-nss :

  - update to 3.13.3 RTM

  - distrust Trustwave's MITM certificates (bmo#724929)

  - fix generic blacklisting mechanism (bmo#727204)

Changes in mozilla-nspr :

  - update to version 4.9 RTM

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Mozilla Firefox was updated to 3.6.28 to fix various bugs and security issues.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-19)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.
    References

    Bob Clary reported two bugs that causes crashes that     affected Firefox 3.6, Firefox ESR, and Firefox 10.
    (CVE-2012-0461)

    Christian Holler, Jesse Ruderman, Nils, Michael     Bebenita, Dindog, and David Anderson reported memory     safety problems and crashes that affect Firefox ESR and     Firefox 10. (CVE-2012-0462)

    Jeff Walden reported a memory safety problem in the     array.join function. This bug was independently reported     by Vincenzo Iozzo via TippingPoint's Zero Day Initiative     Pwn2Own contest. (CVE-2012-0464)

    Masayuki Nakano reported a memory safety problem that     affected Mobile Firefox 10. (CVE-2012-0463)

  - Security researcher Mariusz Mlynski reported that an     attacker able to convince a potential victim to set a     new home page by dragging a link to the 'home' button     can set that user's home page to a javascript: URL. Once     this is done the attacker's page can cause repeated     crashes of the browser, eventually getting the script     URL loaded in the privileged about:sessionrestore     context. (MFSA 2012-16 / CVE-2012-0458)

  - Security researcher Atte Kettunen from OUSPG found two     issues with Firefox's handling of SVG using the Address     Sanitizer tool. The first issue, critically rated, is a     use-after-free in SVG animation that could potentially     lead to arbitrary code execution. The second issue is     rated moderate and is an out of bounds read in SVG     Filters. This could potentially incorporate data from     the user's memory, making it accessible to the page     content. (MFSA 2012-14 / CVE-2012-0457 / CVE-2012-0456)

  - Firefox prevents the dropping of javascript: links onto     a frame to prevent malicious sites from tricking users     into performing a cross-site scripting (XSS) attacks on     themselves. Security researcher Soroush Dalili reported     a way to bypass this protection. (MFSA 2012-13 /     CVE-2012-0455)

The full overview can be found on Mozillas security page at:
http://www.mozilla.org/security/announce/

Mozilla Firefox was updated to 10.0.3 ESR to fix various bugs and security issues.

The following security issues have been fixed :

  - Mozilla developers identified and fixed several memory     safety bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these bugs showed     evidence of memory corruption under certain     circumstances, and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2012-19)

    In general these flaws cannot be exploited through email     in the Thunderbird and SeaMonkey products because     scripting is disabled, but are potentially a risk in     browser or browser-like contexts in those products.

    References :

    Bob Clary reported two bugs that causes crashes that     affected Firefox 3.6, Firefox ESR, and Firefox 10.
    (CVE-2012-0461)

    Christian Holler, Jesse Ruderman, Nils, Michael     Bebenita, Dindog, and David Anderson reported memory     safety problems and crashes that affect Firefox ESR and     Firefox 10. (CVE-2012-0462)

    Jeff Walden reported a memory safety problem in the     array.join function. This bug was independently reported     by Vincenzo Iozzo via TippingPoint's Zero Day Initiative     Pwn2Own contest. (CVE-2012-0464)

    Masayuki Nakano reported a memory safety problem that     affected Mobile Firefox

  - CVE-2012-0463

  - Mozilla developer Matt Brubeck reported that     window.fullScreen is writeable by untrusted content now     that the DOM fullscreen API is enabled. Because     window.fullScreen does not include     mozRequestFullscreen's security protections, it could be     used for UI spoofing. This code change makes     window.fullScreen read only by untrusted content,     forcing the use of the DOM fullscreen API in normal     usage. (MFSA 2012-18 / CVE-2012-0460)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Mozilla community member Daniel Glazman of Disruptive     Innovations reported a crash when accessing a keyframe's     cssText after dynamic modification. This crash may be     potentially exploitable. (MFSA 2012-17 / CVE-2012-0459)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Security researcher Mariusz Mlynski reported that an     attacker able to convince a potential victim to set a     new home page by dragging a link to the 'home' button     can set that user's home page to a javascript: URL. Once     this is done the attacker's page can cause repeated     crashes of the browser, eventually getting the script     URL loaded in the privileged about:sessionrestore     context. (MFSA 2012-16 / CVE-2012-0458)

  - Security Researcher Mike Brooks of Sitewatch reported     that if multiple Content Security Policy (CSP) headers     are present on a page, they have an additive effect page     policy. Using carriage return line feed (CRLF)     injection, a new CSP rule can be introduced which allows     for cross-site scripting (XSS) on sites with a separate     header injection vulnerability. (MFSA 2012-15 /     CVE-2012-0451)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Security researcher Atte Kettunen from OUSPG found two     issues with Firefox's handling of SVG using the Address     Sanitizer tool. The first issue, critically rated, is a     use-after-free in SVG animation that could potentially     lead to arbitrary code execution. The second issue is     rated moderate and is an out of bounds read in SVG     Filters. This could potentially incorporate data from     the user's memory, making it accessible to the page     content. (MFSA 2012-14 / CVE-2012-0457 / CVE-2012-0456)

  - Firefox prevents the dropping of javascript: links onto     a frame to prevent malicious sites from tricking users     into performing a cross-site scripting (XSS) attacks on     themselves. Security researcher Soroush Dalili reported     a way to bypass this protection. (MFSA 2012-13 /     CVE-2012-0455)

  - Security researchers Blair Strang and Scott Bell of     Security Assessment found that when a parent window     spawns and closes a child window that uses the file open     dialog, a crash can be induced in shlwapi.dll on 32-bit     Windows 7 systems. This crash may be potentially     exploitable. (MFSA 2012-12 / CVE-2012-0454)

    Firefox 3.6 and Thunderbird 3.1 are not affected by this     vulnerability.

  - Reworked the KDE4 integration. (bnc#745017)

Versions of Thunderbird 3.1.x earlier than 3.1.20 are potentially affected by the following security issues :

  - Multiple memory corruption issues.  By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the context of the affected application. (CVE-2012-0457, CVE-2012-0461, CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - A security bypass vulnerability that can be exploited by an attacker if the victim can be tricked into setting a new home page by dragging a specially crafted link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL. (CVE-2012-0458)

  - An information disclosure vulnerability due to an out of bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability that can be triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)

Versions of Firefox 10.x earlier than 10.0.3 are potentially affected by the following security issues :

  - Multiple memory corruption issues.  By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the context of the affected application. (CVE-2012-0454, CVE-2012-0457, CVE-2012-0459, CVE-2012-0461, CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - Ah HTTP Header security bypass vulnerability that can be leveraged by attackers to bypass certain security restrictions and conduct cross-site scripting attacks. (CVE-2012-0451)

  - A security bypass vulnerability that can be exploited by an attacker if the victim can be tricked into setting a new home page by dragging a specially crafted link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL. (CVE-2012-0458)

  - An information disclosure vulnerability due to an out of bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability that can be triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content, allowing attackers to perform UI spoofing attacks. (CVE-2012-0460)

Versions of Firefox 3.6.x earlier than 3.6.28 are potentially affected by the following security issues :

  - Multiple memory corruption issues.  By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the context of the affected application. (CVE-2012-0457, CVE-2012-0461, CVE-2012-0463, CVE-2012-0464)

  - A security bypass vulnerability that can be exploited by an attacker if the victim can be tricked into setting a new home page by dragging a specially crafted link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL. (CVE-2012-0458)

  - An information disclosure vulnerability due to an out of bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability that can be triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)

Versions of Mozilla Thunderbird 3.1.x prior to 3.1.20 are affected by the following security issues :

 - Multiple memory corruption issues. By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the context of the affected application. (CVE-2012-0457, CVE-2012-0461, CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)
 - A security bypass vulnerability that can be exploited by an attacker if the victim can be tricked into setting a new home page by dragging a specially crafted link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL. (CVE-2012-0458)
 - An information disclosure vulnerability due to an out of bounds read in SVG filters. (CVE-2012-0456)
 - A cross-site scripting vulnerability that can be triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)

Versions of Firefox 10.x prior to 10.0.3 are affected by the following security issues :

 - Multiple memory corruption issues. By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the context of the affected application. (CVE-2012-0454, CVE-2012-0457, CVE-2012-0459, CVE-2012-0461, CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)
 - An HTTP Header security bypass vulnerability that can be leveraged by attackers to bypass certain security restrictions and conduct cross-site scripting attacks. (CVE-2012-0451)
 - A security bypass vulnerability that can be exploited by an attacker if the victim can be tricked into setting a new home page by dragging a specially crafted link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL. (CVE-2012-0458)
 - An information disclosure vulnerability due to an out of bounds read in SVG filters. (CVE-2012-0456)
 - A cross-site scripting vulnerability that can be triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)
 - 'window.fullScreen' is writeable by untrusted content, allowing attackers to perform UI spoofing attacks. (CVE-2012-0460)

Versions of Firefox 3.6.x earlier than 3.6.28 are potentially affected by the following security issues :

 - Multiple memory corruption issues.  By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the context of the affected application. (CVE-2012-0457, CVE-2012-0461, CVE-2012-0463, CVE-2012-0464)
 - A security bypass vulnerability that can be exploited by an attacker if the victim can be tricked into setting a new home page by dragging a specially crafted link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL. (CVE-2012-0458)
 - An information disclosure vulnerability due to an out of bounds read in SVG filters. (CVE-2012-0456)
 - A cross-site scripting vulnerability that can be triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)

Versions of SeaMonkey 2.x earlier than 2.8 are potentially affected by the following security issues :

  - Multiple memory corruption issues.  By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the context of the affected application. (CVE-2012-0454, CVE-2012-0457, CVE-2012-0459, CVE-2012-0461, CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - Ah HTTP Header security bypass vulnerability that can be leveraged by attackers to bypass certain security restrictions and conduct cross-site scripting attacks. (CVE-2012-0451)

  - A security bypass vulnerability that can be exploited by an attacker if the victim can be tricked into setting a new home page by dragging a specially crafted link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL. (CVE-2012-0458)

  - An information disclosure vulnerability due to an out of bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability that can be triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content, allowing attackers to perform UI spoofing attacks. (CVE-2012-0460)

Versions of Firefox ESR 10.x prior to 10.0.3 are affected by the following security issues :

 - Multiple memory corruption issues.  By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the context of the affected application. (CVE-2012-0454, CVE-2012-0457, CVE-2012-0459, CVE-2012-0461, CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)
 - An HTTP Header security bypass vulnerability that can be leveraged by attackers to bypass certain security restrictions and conduct cross-site scripting attacks. (CVE-2012-0451)
 - A security bypass vulnerability that can be exploited by an attacker if the victim can be tricked into setting a new home page by dragging a specially crafted link to the 'home' button URL, which will set the user's home page to a 'javascript:' URL. (CVE-2012-0458)
 - An information disclosure vulnerability due to an out of bounds read in SVG filters. (CVE-2012-0456)
 - A cross-site scripting vulnerability that can be triggered by dragging and dropping 'javascript:' links onto a frame. (CVE-2012-0455)
 - 'window.fullScreen' is writeable by untrusted content, allowing attackers to perform UI spoofing attacks. (CVE-2012-0460)

The installed version of Thunderbird 3.1.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0457,      CVE-2012-0461, CVE-2012-0462, CVE-2012-0463,     CVE-2012-0464)

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out of bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

The installed version of Thunderbird 10.0.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0454,     CVE-2012-0457, CVE-2012-0459, CVE-2012-0461,     CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - An HTTP Header security bypass vulnerability exists that     can be leveraged by attackers to bypass certain security     restrictions and conduct cross-site scripting attacks.     (CVE-2012-0451).

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out-of-bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content,     allowing attackers to perform UI spoofing attacks.     (CVE-2012-0460)

The installed version of Firefox 3.6.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0457,     CVE-2012-0461, CVE-2012-0463, CVE-2012-0464)

  - A security bypass vulnerability that can be exploited by     an attacker if the victim can be tricked into setting a     new home page by dragging a specially crafted link to     the 'home' button URL, which will set the user's home     page to a 'javascript:' URL. (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out of bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

The installed version of Firefox is earlier than 10.0.3 and thus, is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0454,     CVE-2012-0457, CVE-2012-0459, CVE-2012-0461,     CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - An HTTP Header security bypass vulnerability exists that     can be leveraged by attackers to bypass certain security     restrictions and conduct cross-site scripting attacks.     (CVE-2012-0451).

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out-of-bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content,     allowing attackers to perform UI spoofing attacks.     (CVE-2012-0460)

The installed version of SeaMonkey is earlier than 2.8.0.  Such versions are potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0454,     CVE-2012-0457, CVE-2012-0459, CVE-2012-0461,     CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - An HTTP Header security bypass vulnerability that can be     leveraged by attackers to bypass certain security     restrictions and conduct cross-site scripting attacks.     (CVE-2012-0451).

  - A security bypass vulnerability that can be exploited by     an attacker if the victim can be tricked into setting a     new home page by dragging a specially crafted link to     the 'home' button URL, which will set the user's home     page to a 'javascript:' URL. (CVE-2012-0458) 

  - An information disclosure vulnerability due to an out of     bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content,     allowing attackers to perform UI spoofing attacks.     (CVE-2012-0460)

The installed version of Thunderbird 3.1.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0457,      CVE-2012-0461, CVE-2012-0462, CVE-2012-0463,     CVE-2012-0464)

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out-of-bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

The installed version of Firefox 3.6.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0457,     CVE-2012-0461, CVE-2012-0463, CVE-2012-0464)

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out-of-bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

The installed version of Firefox 10.0.x is potentially affected by the following security issues :
  - Multiple memory corruption issues. By tricking a user     into visiting a specially crafted page, these issues may     allow an attacker to execute arbitrary code in the     context of the affected application. (CVE-2012-0454,     CVE-2012-0457, CVE-2012-0459, CVE-2012-0461,     CVE-2012-0462, CVE-2012-0463, CVE-2012-0464)

  - An HTTP Header security bypass vulnerability exists that     can be leveraged by attackers to bypass certain security     restrictions and conduct cross-site scripting attacks.     (CVE-2012-0451).

  - A security bypass vulnerability exists that can be     exploited by an attacker if the victim can be tricked     into setting a new home page by dragging a specially     crafted link to the 'home' button URL, which will set     the user's home page to a 'javascript:' URL.     (CVE-2012-0458) 

  - An information disclosure vulnerability exists due to an     out-of-bounds read in SVG filters. (CVE-2012-0456)

  - A cross-site scripting vulnerability exists that can be     triggered by dragging and dropping 'javascript:' links     onto a frame. (CVE-2012-0455)

  - 'window.fullScreen' is writeable by untrusted content,     allowing attackers to perform UI spoofing attacks.     (CVE-2012-0460)

The Mozilla Project reports :

MFSA 2012-13 XSS with Drag and Drop and Javascript: URL

MFSA 2012-14 SVG issues found with Address Sanitizer

MFSA 2012-15 XSS with multiple Content Security Policy headers

MFSA 2012-16 Escalation of privilege with Javascript: URL as home page

MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification

MFSA 2012-18 window.fullScreen writeable by untrusted content

MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)

ID	Name	Product	Family	Severity
74574	openSUSE Security Update : MozillaFirefox / MozillaThunderbird (openSUSE-SU-2012:0417-1)	Nessus	SuSE Local Security Checks	high
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
58525	SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8029)	Nessus	SuSE Local Security Checks	high
58524	SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6007)	Nessus	SuSE Local Security Checks	high
801378	Mozilla Thunderbird 3.1.x < 3.1.20 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801370	Mozilla Thunderbird 10.x < 10.0.3 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801364	Mozilla Firefox 3.6.x < 3.6.28 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6353	Mozilla Thunderbird 3.1.x < 3.1.20 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6352	Mozilla Thunderbird 10.x < 10.0.3 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6351	Mozilla Firefox 3.6.x < 3.6.28 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
801337	Mozilla SeaMonkey 2.x < 2.8 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801284	Mozilla Firefox 10.x < 10.0.3 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
6354	SeaMonkey 2.x < 2.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
6350	Mozilla Firefox ESR 10.x < 10.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
58356	Thunderbird 3.1.x < 3.1.20 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
58355	Thunderbird 10.0.x < 10.0.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
58354	Firefox 3.6.x < 3.6.28 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
58353	Firefox < 10.0.3 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	high
58352	SeaMonkey < 2.8.0 Multiple Vulnerabilities	Nessus	Windows	high
58351	Mozilla Thunderbird 3.1.x < 3.1.20 Multiple Vulnerabilities	Nessus	Windows	high
58350	Mozilla Thunderbird 10.0.x < 10.0.3 Multiple Vulnerabilities	Nessus	Windows	high
58349	Firefox 3.6.x < 3.6.28 Multiple Vulnerabilities	Nessus	Windows	high
58348	Firefox 10.0.x < 10.0.3 Multiple Vulnerabilities	Nessus	Windows	high
58347	FreeBSD : mozilla -- multiple vulnerabilities (a1050b8b-6db3-11e1-8b37-0011856a6e37)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-0463

critical

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high