Vulnerability Description
Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 17.0 |
| Mozilla | Seamonkey | < 2.14 |
| Mozilla | Thunderbird | < 17.0 |
| Canonical | Ubuntu Linux | 10.04 |
| Opensuse | Opensuse | 11.4 |
| Suse | Linux Enterprise Desktop | 10 |
| Suse | Linux Enterprise Server | 10 |
| Suse | Linux Enterprise Software Development Kit | 11 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.htmlMailing ListThird Party Advisory
- http://secunia.com/advisories/51369Broken Link
- http://secunia.com/advisories/51370Broken Link
- http://secunia.com/advisories/51381Broken Link
- http://secunia.com/advisories/51434Broken Link
- http://secunia.com/advisories/51439Broken Link
- http://secunia.com/advisories/51440Broken Link
- http://www.mozilla.org/security/announce/2012/mfsa2012-97.htmlVendor Advisory
- http://www.securityfocus.com/bid/56621Third Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-1636-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1638-1Third Party Advisory
FAQ
What is CVE-2012-4205?
CVE-2012-4205 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which al...
How severe is CVE-2012-4205?
CVE-2012-4205 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-4205?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird, Canonical Ubuntu Linux, Opensuse Opensuse.