Vulnerability Description
Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging initial-origin access after document.domain has been set.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 16.0 |
| Mozilla | Seamonkey | < 2.13 |
| Mozilla | Thunderbird | < 16.0 |
| Canonical | Ubuntu Linux | 10.04 |
| Suse | Linux Enterprise Desktop | 10 |
| Suse | Linux Enterprise Server | 10 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.htmlMailing ListThird Party Advisory
- http://osvdb.org/86106Broken Link
- http://secunia.com/advisories/50856Broken Link
- http://secunia.com/advisories/50892Broken Link
- http://secunia.com/advisories/50904Broken Link
- http://secunia.com/advisories/50935Broken Link
- http://secunia.com/advisories/50984Broken Link
- http://www.mozilla.org/security/announce/2012/mfsa2012-76.htmlVendor Advisory
- http://www.ubuntu.com/usn/USN-1611-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=655649Issue TrackingVendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.htmlMailing ListThird Party Advisory
- http://osvdb.org/86106Broken Link
- http://secunia.com/advisories/50856Broken Link
- http://secunia.com/advisories/50892Broken Link
FAQ
What is CVE-2012-3985?
CVE-2012-3985 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting (X...
How severe is CVE-2012-3985?
CVE-2012-3985 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-3985?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird, Canonical Ubuntu Linux, Suse Linux Enterprise Desktop.