Cross-site scripting in Firefox ESR - CVE-2012-3994

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU43405

Cross-site scripting in Firefox ESR - CVE-2012-3994

Published: October 10, 2012 / Updated: August 11, 2020


Vulnerability identifier: #VU43405
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2012-3994
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Mozilla
Affected software:
Firefox ESR

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to conduct cross-site scripting (XSS) attacks via a binary plugin that uses Object.defineProperty to shadow the top object, and leverages the relationship between top.location and the location property.


How to mitigate CVE-2012-3994

Install update from vendor's website.

Sources