Vulnerability Description
The nsLocation::CheckURL function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 does not properly follow the security model of the location object, which allows remote attackers to bypass intended content-loading restrictions or possibly have unspecified other impact via vectors involving chrome code.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 10.0 |
| Mozilla | Thunderbird Esr | 10.0 |
| Mozilla | Thunderbird | <= 14.0 |
| Mozilla | Seamonkey | <= 2.11 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
- http://rhn.redhat.com/errata/RHSA-2012-1210.html
- http://rhn.redhat.com/errata/RHSA-2012-1211.html
- http://www.debian.org/security/2012/dsa-2553
- http://www.debian.org/security/2012/dsa-2554
- http://www.debian.org/security/2012/dsa-2556
- http://www.mozilla.org/security/announce/2012/mfsa2012-70.htmlVendor Advisory
- http://www.securityfocus.com/bid/55306
- http://www.ubuntu.com/usn/USN-1548-1
- http://www.ubuntu.com/usn/USN-1548-2
- http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cer
- https://bugzilla.mozilla.org/show_bug.cgi?id=770429
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
FAQ
What is CVE-2012-3978?
CVE-2012-3978 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The nsLocation::CheckURL function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 does not proper...
How severe is CVE-2012-3978?
CVE-2012-3978 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-3978?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Thunderbird Esr, Mozilla Thunderbird, Mozilla Seamonkey.