Vulnerability Description
Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has multiple menus of SELECT elements active, which allows remote attackers to conduct clickjacking attacks via vectors involving an XPI file, the window.open method, and the Geolocation API, a different vulnerability than CVE-2012-3984.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 16.0 |
| Mozilla | Seamonkey | < 2.13 |
| Mozilla | Thunderbird | < 16.0 |
References
- http://osvdb.org/86171Broken Link
- http://secunia.com/advisories/50856Broken Link
- http://secunia.com/advisories/50935Broken Link
- http://www.mozilla.org/security/announce/2012/mfsa2012-75.htmlVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=726264Issue TrackingVendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Third Party Advisory
- http://osvdb.org/86171Broken Link
- http://secunia.com/advisories/50856Broken Link
- http://secunia.com/advisories/50935Broken Link
- http://www.mozilla.org/security/announce/2012/mfsa2012-75.htmlVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=726264Issue TrackingVendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Third Party Advisory
FAQ
What is CVE-2012-5354?
CVE-2012-5354 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has multiple menus of SELECT elements active, which allows r...
How severe is CVE-2012-5354?
CVE-2012-5354 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-5354?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird.