CVSS: 6.8EPSS: 0%CPEs: 27EXPL: 1CVE-2012-4196 – Mozilla: Fixes for Location object issues (MFSA 2012-90)
https://notcve.org/view.php?id=CVE-2012-4196
Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object. Mozilla Firefox anteriores a v16.0.2, Firefox ESR v10.x anteriores a v10.0.10, Thunderbird anteriores a v16.0.2, Thunderbird ESR v10.x anteriores a v10.0.10, y SeaMonkey anteriores a v2.13.2, permiten a atacantes remotos evitar la Same Origin Policy y leer la localización del objeto a través de un ataque "prototype property-injection" que elimina ciertos mecanismos de protección para ese objeto. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.html http://rhn.redhat.com/errata/RHSA-2012-1407.html http://rhn.redhat.com/errata/RHSA-2012-1413.html http://secunia.com/advisories/51121 http://secunia.com/advisories/51123 http://secunia.com/advisories/51127 http://secunia.com/advisories/51144 http://secunia.com/advisories/51146 http://secunia.com/advisories/51147 http://secunia.c • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.8EPSS: 2%CPEs: 22EXPL: 1CVE-2012-4193 – Mozilla: defaultValue security checks not applied (MFSA 2012-89)
https://notcve.org/view.php?id=CVE-2012-4193
Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same Origin Policy and read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site. Mozilla Firefox anteriores a v16.0.1, Firefox ESR v10.x anteriores a v10.0.9, Thunderbird anteriores a v16.0.1, Thunderbird ESR v10.x anteriores a v10.0.9, y SeaMonkey anteriores a v2.13.1 omite un chekeo de seguridad en la función defaultValue durante el desempaqueta de una envoltura de seguridad, lo que permite a atacantes remotos evitar la política "Same Origin Policy" y leer las propiedades del objeto Location, or ejecutar código JavaScript a través de un sitio Web moficado. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html http://rhn.redhat.com/errata/RHSA-2012-1361.html http://rhn.redhat.com/errata/RHSA-2012-1362.html http://secunia.com/advisories/50904 http://secunia.com/advisories/50906 http://secunia.com/advisories/50907 http://secunia.com/advisories/50964 http://secunia.com/advisories/50984 http://secunia.com/advisories/55318 http://www.mozilla.org/security/announce/2012/mfsa2012-89.html http://www.ubuntu.com/ • CWE-346: Origin Validation Error •
CVSS: 6.8EPSS: 0%CPEs: 22EXPL: 0CVE-2012-4184 – Mozilla: Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties (MFSA 2012-83)
https://notcve.org/view.php?id=CVE-2012-4184
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not prevent access to properties of a prototype for a standard class, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site. La implementación Chrome Object Wrapper (COW) en Mozilla Firefox v16.0, Firefox ESR v10.x antes de v10.0.8, Thunderbird antes de v16.0, Thunderbird ESR v10.x antes de v10.0.8, y SeaMonkey antes de v2.13, no previene el acceso a las propiedades de un prototipo para una clase estandar, lo que permite a atacantes remotos ejecutar código JavaScript de su elección con privilegios chrome a través de una pagina web manipulada. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html http://osvdb.org/86113 http://rhn.redhat.com/errata/RHSA-2012-1351.html http://secunia.com/advisories/50892 http://secunia.com/advisories/50904 http://secunia.com/advisories/50984 http://secunia.com/advisories/55318 http://www.mandriva.com/security/advisories?name=MDVSA-2012:163 http://www.mozilla.org/security/announce/2012/mfsa2012-83.html http://www.securityfocus.com/bid/56120 http://www.ubuntu.c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 1%CPEs: 23EXPL: 0CVE-2012-3982 – Mozilla: Miscellaneous memory safety hazards (rv:10.0.8) (MFSA 2012-74)
https://notcve.org/view.php?id=CVE-2012-3982
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Múltiples vulnerabilidades no especificadas en el motor del navegador de Mozilla Firefox antes de v16.0, Firefox ESR v10.x antes de v10.0.8, Thunderbird antes de v16.0, Thunderbird ESR v10.x antes de v10.0.8 y SeaMonkey antes de v2.13 permiten a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de la aplicación) o posiblemente ejecutar código de su elección a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html http://rhn.redhat.com/errata/RHSA-2012-1351.html http://secunia.com/advisories/50856 http://secunia.com/advisories/50892 http://secunia.com/advisories/50904 http://secunia.com/advisories/50935 http://secunia.com/advisories/50936 http://secunia.com/advisories/50984 http://secunia.com/advisories/51181 http://secunia.com/advisories/55318 http://www.debian.org/security/2012/dsa-2565 http://www.debian&# •
CVSS: 4.3EPSS: 0%CPEs: 23EXPL: 0CVE-2012-3986 – Mozilla: Some DOMWindowUtils methods bypass security checks (MFSA 2012-77)
https://notcve.org/view.php?id=CVE-2012-3986
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code. Mozilla Firefox v16.0, Firefox ESR v10.x antes de v10.0.8, Thunderbird antes de v16.0, Thunderbird ESR v10.x antes de v10.0.8, y SeaMonkey antes de v2.13, no restringe correctamente las llamadas a métodos DOMWindowUtils (alias nsDOMWindowUtils), lo que permite a atacantes remotos evitar las restricciones de acceso a través de código JavaScript manipulado. • http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html http://rhn.redhat.com/errata/RHSA-2012-1351.html http://secunia.com/advisories/50856 http://secunia.com/advisories/50892 http://secunia.com/advisories/50904 http://secunia.com/advisories/50935 http://secunia.com/advisories/50936 http://secunia.com/advisories/50984 http://secunia.com/advisories/51181 http://secunia.com/advisories/55318 http://www.debian.org/security/2012/dsa-2565 http://www.debian&# • CWE-20: Improper Input Validation •