CVE-2012-0444

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 3.6.26
mozillafirefox
4.0 ≤
𝑥
< 10.0
mozillaseamonkey
𝑥
< 2.7
mozillathunderbird
𝑥
< 3.1.18
mozillathunderbird
5.0 ≤
𝑥
< 10.0
debiandebian_linux
5.0
debiandebian_linux
6.0
opensuseopensuse
11.4
canonicalubuntu_linux
10.04
canonicalubuntu_linux
10.10
canonicalubuntu_linux
11.04
canonicalubuntu_linux
11.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libvorbis
bookworm
1.3.7-1
fixed
bullseye
1.3.7-1
fixed
lenny
not-affected
sid
1.3.7-2
fixed
squeeze
no-dsa
trixie
1.3.7-2
fixed
libvorbisidec
bookworm
1.2.1+git20180316-7
fixed
bullseye
1.2.1+git20180316-7
fixed
lenny
not-affected
sid
1.2.1+git20180316-8
fixed
squeeze
no-dsa
trixie
1.2.1+git20180316-8
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
hardy
ignored
lucid
Fixed 10.0+build1-0ubuntu0.10.04.2
released
maverick
Fixed 10.0+build1-0ubuntu0.10.10.1
released
natty
Fixed 10.0+build1-0ubuntu0.11.04.1
released
oneiric
Fixed 10.0+build1-0ubuntu0.11.10.1
released
precise
not-affected
quantal
not-affected
raring
not-affected
saucy
not-affected
libvorbis
hardy
ignored
lucid
Fixed 1.2.3-3ubuntu1.1
released
maverick
Fixed 1.3.1-1ubuntu0.1
released
natty
Fixed 1.3.2-1ubuntu1.1
released
oneiric
Fixed 1.3.2-1ubuntu2.1
released
precise
Fixed 1.3.2-1ubuntu3
released
quantal
Fixed 1.3.2-1ubuntu3
released
raring
Fixed 1.3.2-1ubuntu3
released
saucy
Fixed 1.3.2-1ubuntu3
released
seamonkey
hardy
ignored
lucid
ignored
maverick
ignored
natty
ignored
oneiric
ignored
precise
dne
quantal
dne
raring
dne
saucy
dne
thunderbird
hardy
ignored
lucid
Fixed 3.1.18+build2+nobinonly-0ubuntu0.10.04.1
released
maverick
Fixed 3.1.18+build2+nobinonly-0ubuntu0.10.10.1
released
natty
Fixed 3.1.18+build2+nobinonly-0ubuntu0.11.04.1
released
oneiric
Fixed 10.0.2+build1-0ubuntu0.11.10.1
released
precise
not-affected
quantal
not-affected
raring
not-affected
saucy
not-affected
xulrunner-1.9.2
hardy
ignored
lucid
Fixed 1.9.2.26+build2+nobinonly-0ubuntu0.10.04.1
released
maverick
Fixed 1.9.2.26+build2+nobinonly-0ubuntu0.10.10.1
released
natty
Fixed 1.9.2.27+build1+nobinonly-0ubuntu0.11.04.1
released
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
xulrunner-2.0
hardy
dne
lucid
dne
maverick
dne
natty
ignored
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
MozillaFirefox
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-devel
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-translations-common
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-translations-other
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaThunderbird
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
MozillaThunderbird-devel
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise workstation 15
52.8-1.2
fixed
MozillaThunderbird-translations-common
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
MozillaThunderbird-translations-other
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
libvorbis-devel
suse enterprise desktop 15
1.3.6-2.16
fixed
suse enterprise desktop 15 SP1
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP2
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP3
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP4
1.3.6-4.3.1
fixed
suse enterprise sap 15
1.3.6-2.16
fixed
suse enterprise sap 15 SP1
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP2
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP3
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP4
1.3.6-4.3.1
fixed
suse enterprise server 15
1.3.6-2.16
fixed
suse enterprise server 15 SP1
1.3.6-4.3.1
fixed
suse enterprise server 15 SP2
1.3.6-4.3.1
fixed
suse enterprise server 15 SP3
1.3.6-4.3.1
fixed
suse enterprise server 15 SP4
1.3.6-4.3.1
fixed
libvorbis-doc
suse enterprise sap 12 SP5
1.3.3-10.14.1
fixed
suse enterprise server 12 SP5
1.3.3-10.14.1
fixed
libvorbis0
suse enterprise desktop 15
1.3.6-2.16
fixed
suse enterprise desktop 15 SP1
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP2
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP3
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP4
1.3.6-4.3.1
fixed
suse enterprise sap 12 SP5
1.3.3-10.14.1
fixed
suse enterprise sap 15
1.3.6-2.16
fixed
suse enterprise sap 15 SP1
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP2
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP3
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP4
1.3.6-4.3.1
fixed
suse enterprise server 12 SP5
1.3.3-10.14.1
fixed
suse enterprise server 15
1.3.6-2.16
fixed
suse enterprise server 15 SP1
1.3.6-4.3.1
fixed
suse enterprise server 15 SP2
1.3.6-4.3.1
fixed
suse enterprise server 15 SP3
1.3.6-4.3.1
fixed
suse enterprise server 15 SP4
1.3.6-4.3.1
fixed
libvorbis0-32bit
suse enterprise sap 12 SP5
1.3.3-10.14.1
fixed
suse enterprise server 12 SP5
1.3.3-10.14.1
fixed
libvorbisenc2
suse enterprise desktop 15
1.3.6-2.16
fixed
suse enterprise desktop 15 SP1
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP2
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP3
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP4
1.3.6-4.3.1
fixed
suse enterprise sap 12 SP5
1.3.3-10.14.1
fixed
suse enterprise sap 15
1.3.6-2.16
fixed
suse enterprise sap 15 SP1
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP2
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP3
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP4
1.3.6-4.3.1
fixed
suse enterprise server 12 SP5
1.3.3-10.14.1
fixed
suse enterprise server 15
1.3.6-2.16
fixed
suse enterprise server 15 SP1
1.3.6-4.3.1
fixed
suse enterprise server 15 SP2
1.3.6-4.3.1
fixed
suse enterprise server 15 SP3
1.3.6-4.3.1
fixed
suse enterprise server 15 SP4
1.3.6-4.3.1
fixed
libvorbisenc2-32bit
suse enterprise sap 12 SP5
1.3.3-10.14.1
fixed
suse enterprise server 12 SP5
1.3.3-10.14.1
fixed
libvorbisfile3
suse enterprise desktop 15
1.3.6-2.16
fixed
suse enterprise desktop 15 SP1
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP2
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP3
1.3.6-4.3.1
fixed
suse enterprise desktop 15 SP4
1.3.6-4.3.1
fixed
suse enterprise sap 12 SP5
1.3.3-10.14.1
fixed
suse enterprise sap 15
1.3.6-2.16
fixed
suse enterprise sap 15 SP1
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP2
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP3
1.3.6-4.3.1
fixed
suse enterprise sap 15 SP4
1.3.6-4.3.1
fixed
suse enterprise server 12 SP5
1.3.3-10.14.1
fixed
suse enterprise server 15
1.3.6-2.16
fixed
suse enterprise server 15 SP1
1.3.6-4.3.1
fixed
suse enterprise server 15 SP2
1.3.6-4.3.1
fixed
suse enterprise server 15 SP3
1.3.6-4.3.1
fixed
suse enterprise server 15 SP4
1.3.6-4.3.1
fixed
libvorbisfile3-32bit
suse enterprise sap 12 SP5
1.3.3-10.14.1
fixed
suse enterprise server 12 SP5
1.3.3-10.14.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
firefox
RHEL 6
0:3.6.26-1.el6_2
fixed
libvorbis
RHEL 6
1:1.2.3-4.el6_2.1
fixed
libvorbis-devel
RHEL 6
1:1.2.3-4.el6_2.1
fixed
libvorbis-devel-docs
RHEL 6
1:1.2.3-4.el6_2.1
fixed
xulrunner
RHEL 6
0:1.9.2.26-1.el6_2
fixed
xulrunner-devel
RHEL 6
0:1.9.2.26-1.el6_2
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html
http://secunia.com/advisories/48043
http://secunia.com/advisories/48095
http://www.debian.org/security/2012/dsa-2400
http://www.debian.org/security/2012/dsa-2402
http://www.debian.org/security/2012/dsa-2406
http://www.mandriva.com/security/advisories?name=MDVSA-2012:013
http://www.mozilla.org/security/announce/2012/mfsa2012-07.html
http://www.securityfocus.com/bid/51753
http://www.ubuntu.com/usn/USN-1370-1
https://bugzilla.mozilla.org/show_bug.cgi?id=719612
https://exchange.xforce.ibmcloud.com/vulnerabilities/72858
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14464
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html
http://secunia.com/advisories/48043
http://secunia.com/advisories/48095
http://www.debian.org/security/2012/dsa-2400
http://www.debian.org/security/2012/dsa-2402
http://www.debian.org/security/2012/dsa-2406
http://www.mandriva.com/security/advisories?name=MDVSA-2012:013
http://www.mozilla.org/security/announce/2012/mfsa2012-07.html
http://www.securityfocus.com/bid/51753
http://www.ubuntu.com/usn/USN-1370-1
https://bugzilla.mozilla.org/show_bug.cgi?id=719612
https://exchange.xforce.ibmcloud.com/vulnerabilities/72858
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14464