Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has multiple menus of SELECT elements active, which allows remote attackers to conduct clickjacking attacks via vectors involving an XPI file, the window.open method, and the Geolocation API, a different vulnerability than CVE-2012-3984.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

The installed version of SeaMonkey is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - '<select>' elements can be abused to cover arbitrary     portions of a newly loaded page and may also be utilized     for click-jacking attacks. (CVE-2012-3984,     CVE-2012-5354)

  - A violation in the HTML specification for     'document.domain' behavior can be abused, potentially     leading to cross-site scripting attacks. (CVE-2012-3985)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - A potentially exploitable crash can be caused when     making an invalid cast using the 'instanceof' operator     on certain types of JavaScript objects. (CVE-2012-3989)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.     (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.     (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.     (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

The installed version of Thunderbird is earlier than 16.0 and thus, is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - '<select>' elements can be abused to cover arbitrary     portions of a newly loaded page and may also be utilized     for click-jacking attacks. (CVE-2012-3984,     CVE-2012-5354)

  - A violation in the HTML specification for     'document.domain' behavior can be abused, potentially     leading to cross-site scripting attacks. (CVE-2012-3985)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - A potentially exploitable crash can be caused when     making an invalid cast using the 'instanceof' operator     on certain types of JavaScript objects. (CVE-2012-3989)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.
    (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.
    (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.
    (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

The installed version of Firefox is earlier than 16.0 and thus, is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - '<select>' elements can be abused to cover arbitrary     portions of a newly loaded page and may also be utilized     for click-jacking attacks. (CVE-2012-3984,     CVE-2012-5354)

  - A violation in the HTML specification for     'document.domain' behavior can be abused, potentially     leading to cross-site scripting attacks. (CVE-2012-3985)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - A potentially exploitable crash can be caused when     making an invalid cast using the 'instanceof' operator     on certain types of JavaScript objects. (CVE-2012-3989)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.     (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.     (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.     (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

The installed version of Thunderbird is earlier than 16.0 and thus, is affected by the following vulnerabilities :

  - Several memory safety bugs exist in the browser engine     used in Mozilla-based products that could be exploited     to execute arbitrary code. (CVE-2012-3983)

  - '<select>' elements can be abused to cover arbitrary     portions of a newly loaded page and may also be utilized     for click-jacking attacks. (CVE-2012-3984,     CVE-2012-5354)

  - A violation in the HTML specification for     'document.domain' behavior can be abused, potentially     leading to cross-site scripting attacks. (CVE-2012-3985)

  - Some methods of a feature used for testing     (DOMWindowUtils) are not properly protected and may be     called through script by web pages. (CVE-2012-3986)

  - A potentially exploitable denial of service may be     caused by a combination of invoking full-screen mode and     navigating backwards in history. (CVE-2012-3988)

  - A potentially exploitable crash can be caused when     making an invalid cast using the 'instanceof' operator     on certain types of JavaScript objects. (CVE-2012-3989)

  - When the 'GetProperty' function is invoked through JSAP,     security checking can by bypassed when getting cross-     origin properties, potentially allowing arbitrary code     execution. (CVE-2012-3991)

  - The 'location' property can be accessed by binary     plugins through 'top.location' and 'top' can be shadowed     by 'Object.defineProperty', potentially allowing cross-     site scripting attacks through plugins. (CVE-2012-3994)

  - The Chrome Object Wrapper (COW) has flaws that could     allow access to privileged functions, allowing for cross-     site scripting attacks or arbitrary code execution.     (CVE-2012-3993, CVE-2012-4184)

  - The 'location.hash' property is vulnerable to an attack     that could allow an attacker to inject script or     intercept post data. (CVE-2012-3992)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable use-after-free flaws.     (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179,     CVE-2012-4180, CVE-2012-4181, CVE-2012-4182,     CVE-2012-4183)

  - The 'Address Sanitizer' tool is affected by multiple,     potentially exploitable heap memory corruption issues.     (CVE-2012-4185, CVE-2012-4186, CVE-2012-4187,     CVE-2012-4188)

Versions of Firefox prior to 16.0.1 are affected by the following security issues :

 - Multiple memory-corruption vulnerabilities in the browser engine that could lead to arbitrary code execution. (CVE-2012-3982, CVE-2012-3983, CVE-2012-4191)
 - A URI-spoofing vulnerability due to an error when handling the '<select>' dropdown menu. This issue can be exploited to display arbitrary content while showing the URL of another site. An attacker can also exploit this issue to cause click jacking attacks. (CVE-2012-3984, CVE-2012-5354)
 - A security-bypass vulnerability exists because it fails to properly enforce the same-origin policy. Specifically, the error occurs when handling 'document.domain'. An attacker can exploit this issue to execute cross-site scripting attacks. (CVE-2012-3985)
 - Multiple security bypass vulnerabilities exists in the 'nsDOMWindowUtils' methods. (CVE-2012-3986)
 - A cross-site scripting vulnerability exists because it fails to sufficiently sanitize user-supplied input. Specifically, this issue occurs when transitioning into Reader Mode. Note: This issue affects only Firefox for Android. CVE-2012-3987)
 - A use-after-free issue occurs when invoking full screen mode and navigating backwards in history. (CVE-2012-3988)
 - A denial-of-service vulnerability that occurs due to invalid cast error. Specifically, this issue occurs when using the instanceof operator on certain JavaScript objects. (CVE-2012-3989)
 - A security-bypass vulnerability exists because it fails to properly enforce the cross-origin policy. Specifically, this issue occurs when invoking the 'GetProperty()' function through JSAPI. An attacker can exploit this issue to perform arbitrary code-execution. (CVE-2012-3991)
 - A cross-site scripting vulnerability exists because it fails to sufficiently sanitize user-supplied input. Specifically, this issue occurs when handling the 'location' property through binary plugins. (CVE-2012-3994)
 - A security-bypass vulnerability exists because of an error in the Chrome Object Wrapper (COW) when handling the 'InstallTrigger' object. An attacker can exploit this issue to access certain privileged functions and properties. (CVE-2012-4184, CVE-2012-3993)
 - An arbitrary code-execution occurs when handling the 'location.hash' property and history navigation. (CVE-2012-3992)
 - An out-of-bounds read error affects the 'IsCSSWordSpacingSpace()' function. (CVE-2012-3995)
 - A use-after-free error affects the 'nsHTMLCSSUtils::CreateCSSPropertyTxn()' function. (CVE-2012-4179)
 - A heap-based buffer-overflow vulnerability exists in the 'nsHTMLEditor::IsPrevCharInNodeWhitespace()' function. (CVE-2012-4180)
 - A use-after-free error affects the 'nsSMILAnimationController::DoSample()' function. (CVE-2012-4181)
 - A use-after-free error affects the 'nsTextEditRules::WillInsert()' function. (CVE-2012-4182)
 - A use-after-free error affects the 'DOMSVGTests::GetRequiredFeatures()' function. (CVE-2012-4183)
 - A buffer-overflow vulnerability exists in the 'nsCharTraits::length()' function. (CVE-2012-4185)
 - A heap-based buffer-overflow vulnerability exists in the 'nsWaveReader::DecodeAudioData()' function. (CVE-2012-4186)
 - A memory-corruption vulnerability exists in the 'insPos' property. (CVE-2012-4187)
 - A heap-based buffer-overflow exists in the 'Convolve3x3()' function. (CVE-2012-4188)
 - A use-after-free error affects the 'nsIContent::GetNameSpaceID()' function. (CVE-2012-3990)
 - A cross domain information disclosure exists due to improper access to the 'location' object. (CVE-2012-4192)
 - A security-bypass vulnerability exists due to an error in security wrappers does not unwrap the 'defaultValue()' function properly. An attacker can exploit this issue to gain access to the 'location' object. (CVE-2012-4193)
 These vulnerabilities allow attackers to execute arbitrary script or HTML code, steal cookie-based authentication credentials, conduct phishing attacks, execute arbitrary code in the context of the vulnerable application, crash affected applications, obtain potentially sensitive information, gain escalated privileges, bypass security restrictions, and perform unauthorized actions; other attacks may also be possible.

Versions of SeaMonkey 2.x prior to 2.13 are potentially affected by the following security issues :

 - Multiple memory-corruption vulnerabilities in the browser engine exist which could lead to arbitrary code execution. (CVE-2012-3982, CVE-2012-3983, CVE-2012-4191)
 - A URI-spoofing vulnerability exists due to an error when handling the '<select>' dropdown menu. This issue can be exploited to display arbitrary content while showing the URL of another site. An attacker can also exploit this issue to cause click jacking attacks. (CVE-2012-3984)
 - A security-bypass vulnerability exists because it fails to properly enforce the same-origin policy. Specifically, the error occurs when handling 'document.domain'. An attacker can exploit this issue to execute cross-site scripting attacks. (CVE-2012-3985)
 - Multiple security bypass vulnerabilities exist in the 'nsDOMWindowUtils' methods. (CVE-2012-3986)
 - A use-after-free issue occurs when invoking full screen mode and navigating backwards in history. (CVE-2012-3988)
 - A denial-of-service vulnerability exists due to an invalid cast error. Specifically, this issue occurs when using the instanceof operator on certain JavaScript objects. (CVE-2012-3989)
 - A security-bypass vulnerability exists because it fails to properly enforce the cross-origin policy. Specifically, this issue occurs when invoking the 'GetProperty()' function through JSAPI. An attacker can exploit this issue to perform arbitrary code-execution. (CVE-2012-3991)
 - A cross-site scripting vulnerability exists because it fails to sufficiently sanitize user-supplied input. Specifically, this issue occurs when handling the 'location' property through binary plugins. (CVE-2012-3994)
 - A security-bypass vulnerability exists because of an error in the Chrome Object Wrapper (COW) when handling the 'InstallTrigger' object. An attacker can exploit this issue to access certain privileged functions and properties. (CVE-2012-4184, CVE-2012-3993)
 - An arbitrary code-execution occurs when handling the 'location.hash' property and history navigation. (CVE-2012-3992)
 - An out-of-bounds read error affects the 'IsCSSWordSpacingSpace()' function. (CVE-2012-3995)
 - A use-after-free error affects the 'nsHTMLCSSUtils::CreateCSSPropertyTxn()' function. (CVE-2012-4179)
 - A heap-based buffer-overflow vulnerability exists in the 'nsHTMLEditor::IsPrevCharInNodeWhitespace()' function. (CVE-2012-4180)
 - A use-after-free error affects the 'nsSMILAnimationController::DoSample()' function. (CVE-2012-4181)
 - A use-after-free error affects the 'nsTextEditRules::WillInsert()' function. (CVE-2012-4182)
 - A use-after-free error affects the 'DOMSVGTests::GetRequiredFeatures()' function. (CVE-2012-4183)
 - A buffer-overflow vulnerability exists in the 'nsCharTraits::length()' function. (CVE-2012-4185)
 - A heap-based buffer-overflow vulnerability exists in the 'nsWaveReader::DecodeAudioData()" function. (CVE-2012-4186)
 - A memory-corruption vulnerability exists in the 'insPos' property. (CVE-2012-4187)
 - A heap-based buffer-overflow exists in the 'Convolve3x3()' function. (CVE-2012-4188)
 - A use-after-free error affects the 'nsIContent::GetNameSpaceID()' function. (CVE-2012-3990)
 - A cross domain information disclosure exists due to improper access to the 'location' object. (CVE-2012-4192)
 - A security-bypass vulnerability exists due to an error in security wrappers that does not unwrap the 'defaultValue()' function properly. An attacker can exploit this issue to gain access to the 'location' object. (CVE-2012-4193)

These vulnerabilities allow attackers to execute arbitrary script or HTML code, steal cookie-based authentication credentials, conduct phishing attacks, execute arbitrary code in the context of the vulnerable application, crash affected applications, obtain potentially sensitive information, gain escalated privileges, bypass security restrictions, and perform unauthorized actions; other attacks may also be possible.

Versions of Firefox prior to 16.0 are potentially affected by the following security issues :

 - Multiple memory-corruption vulnerabilities in the browser engine that could lead to arbitrary code execution. (CVE-2012-3982, CVE-2012-3983, CVE-2012-4191)
 - A URI-spoofing vulnerability due to an error when handling the '<select>' dropdown menu. This issue can be exploited to display arbitrary content while showing the URL of another site. An attacker can also exploit this issue to cause click jacking attacks. (CVE-2012-3984, CVE-2012-5354)
 - A security-bypass vulnerability exists because it fails to properly enforce the same-origin policy. Specifically, the error occurs when handling 'document.domain'. An attacker can exploit this issue to execute cross-site scripting attacks. (CVE-2012-3985)
 - Multiple security bypass vulnerabilities exists in the 'nsDOMWindowUtils' methods. (CVE-2012-3986)
 - A cross-site scripting vulnerability exists because it fails to sufficiently sanitize user-supplied input. Specifically, this issue occurs when transitioning into Reader Mode. Note: This issue affects only Firefox for Android. CVE-2012-3987)
 - A use-after-free issue occurs when invoking full screen mode and navigating backwards in history. (CVE-2012-3988)
 - A denial-of-service vulnerability that occurs due to invalid cast error. Specifically, this issue occurs when using the instanceof operator on certain JavaScript objects. (CVE-2012-3989)
 - A security-bypass vulnerability exists because it fails to properly enforce the cross-origin policy. Specifically, this issue occurs when invoking the 'GetProperty()' function through JSAPI. An attacker can exploit this issue to perform arbitrary code-execution. (CVE-2012-3991)
 - A cross-site scripting vulnerability exists because it fails to sufficiently sanitize user-supplied input. Specifically, this issue occurs when handling the 'location' property through binary plugins. (CVE-2012-3994)
 - A security-bypass vulnerability exists because of an error in the Chrome Object Wrapper (COW) when handling the 'InstallTrigger' object. An attacker can exploit this issue to access certain privileged functions and properties. (CVE-2012-4184, CVE-2012-3993)
 - An arbitrary code-execution occurs when handling the 'location.hash' property and history navigation. (CVE-2012-3992)
 - An out-of-bounds read error affects the 'IsCSSWordSpacingSpace()' function. (CVE-2012-3995)
 - A use-after-free error affects the 'nsHTMLCSSUtils::CreateCSSPropertyTxn()' function. (CVE-2012-4179)
 - A heap-based buffer-overflow vulnerability exists in the 'nsHTMLEditor::IsPrevCharInNodeWhitespace()' function. (CVE-2012-4180)
 - A use-after-free error affects the 'nsSMILAnimationController::DoSample()' function. (CVE-2012-4181)
 - A use-after-free error affects the 'nsTextEditRules::WillInsert()' function. (CVE-2012-4182)
 - A use-after-free error affects the 'DOMSVGTests::GetRequiredFeatures()' function. (CVE-2012-4183)
 - A buffer-overflow vulnerability exists in the 'nsCharTraits::length()' function. (CVE-2012-4185)
 - A heap-based buffer-overflow vulnerability exists in the 'nsWaveReader::DecodeAudioData()" function. (CVE-2012-4186)
 - A memory-corruption vulnerability exists in the 'insPos' property. (CVE-2012-4187)
 - A heap-based buffer-overflow exists in the 'Convolve3x3()' function. (CVE-2012-4188)
 - A use-after-free error affects the 'nsIContent::GetNameSpaceID()' function. (CVE-2012-3990)

 - A cross domain information disclosure exists due to improper access to the 'location' object. (CVE-2012-4192)
 - A security-bypass vulnerability exists due to an error in security wrappers does not unwrap the 'defaultValue()' function properly. An attacker can exploit this issue to gain access to the 'location' object. (CVE-2012-4193)
These vulnerabilities allow attackers to execute arbitrary script or HTML code, steal cookie-based authentication credentials, conduct phishing attacks, execute arbitrary code in the context of the vulnerable application, crash affected applications, obtain potentially sensitive information, gain escalated privileges, bypass security restrictions, and perform unauthorized actions; other attacks may also be possible.

ID	Name	Product	Family	Severity
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
62583	SeaMonkey < 2.13 Multiple Vulnerabilities	Nessus	Windows	critical
62582	Mozilla Thunderbird < 16.0 Multiple Vulnerabilities	Nessus	Windows	critical
62580	Firefox < 16.0 Multiple Vulnerabilities	Nessus	Windows	critical
62578	Mozilla Thunderbird < 16.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
62576	Firefox < 16.0 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
6604	Mozilla Thunderbird < 16.0.1 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	high
6603	SeaMonkey 2.x < 2.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
6602	Mozilla Firefox < 16.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2012-5354

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high

high