CVE-2012-1966

MEDIUM

Description

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

References

http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html

http://osvdb.org/84009

http://rhn.redhat.com/errata/RHSA-2012-1088.html

http://secunia.com/advisories/49964

http://secunia.com/advisories/49965

http://secunia.com/advisories/49972

http://secunia.com/advisories/49979

http://secunia.com/advisories/49992

http://www.debian.org/security/2012/dsa-2514

http://www.mozilla.org/security/announce/2012/mfsa2012-46.html

http://www.securityfocus.com/bid/54577

http://www.securitytracker.com/id?1027256

http://www.ubuntu.com/usn/USN-1509-1

http://www.ubuntu.com/usn/USN-1509-2

https://bugzilla.mozilla.org/show_bug.cgi?id=734076

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17037

Details

Source: MITRE

Published: 2012-07-18

Updated: 2017-12-29

Type: CWE-264

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:5.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:6.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:6.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:6.0.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:7.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:7.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:8.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:9.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:9.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:11.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:12.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:12.0:beta6:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox:13.0:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:mozilla:firefox_esr:10.0:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:10.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:10.0.2:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:10.0.3:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:10.0.4:*:*:*:*:*:*:*

cpe:2.3:a:mozilla:firefox_esr:10.0.5:*:*:*:*:*:*:*

Tenable Plugins

View all (21 total)

IDNameProductFamilySeverity
80787Oracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird7)NessusSolaris Local Security Checks
critical
74693openSUSE Security Update : xulrunner (openSUSE-SU-2012:0924-1)NessusSuSE Local Security Checks
critical
74687openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:0899-1)NessusSuSE Local Security Checks
critical
68578Oracle Linux 5 / 6 : firefox (ELSA-2012-1088)NessusOracle Linux Local Security Checks
critical
64131SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6574)NessusSuSE Local Security Checks
critical
63402GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)NessusGentoo Local Security Checks
critical
61963Mandriva Linux Security Advisory : mozilla (MDVSA-2012:110-1)NessusMandriva Local Security Checks
critical
61402FreeBSD : mozilla -- multiple vulnerabilities (dbf338d0-dce5-11e1-b655-14dae9ebcf89)NessusFreeBSD Local Security Checks
critical
61364Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120717)NessusScientific Linux Local Security Checks
critical
801282Mozilla Firefox 13.x < 13 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
6519Mozilla Firefox < 14.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
60092SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8226)NessusSuSE Local Security Checks
critical
60043Firefox < 14.0 Multiple VulnerabilitiesNessusWindows
critical
60042Firefox 10.0.x < 10.0.6 Multiple VulnerabilitiesNessusWindows
critical
60039Firefox < 14.0 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
60038Firefox < 10.0.6 Multiple Vulnerabilities (Mac OS X)NessusMacOS X Local Security Checks
critical
60013Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : ubufox update (USN-1509-2)NessusUbuntu Local Security Checks
critical
60012Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1509-1)NessusUbuntu Local Security Checks
critical
60008RHEL 5 / 6 : firefox (RHSA-2012:1088)NessusRed Hat Local Security Checks
critical
60005Debian DSA-2514-1 : iceweasel - several vulnerabilitiesNessusDebian Local Security Checks
critical
59998CentOS 5 / 6 : firefox (CESA-2012:1088)NessusCentOS Local Security Checks
critical