CVE-2012-4209
21.11.2012, 12:55
Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the location property, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a binary plugin.
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | 𝑥 < 17.0 |
| mozilla | firefox | 10.0 ≤ 𝑥 < 10.0.11 |
| mozilla | seamonkey | 𝑥 < 2.14 |
| mozilla | thunderbird | 𝑥 < 17.0 |
| mozilla | thunderbird_esr | 10.0 ≤ 𝑥 < 10.0.11 |
| opensuse | opensuse | 11.4 |
| opensuse | opensuse | 12.1 |
| opensuse | opensuse | 12.2 |
| redhat | enterprise_linux_desktop | 5.0 |
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_eus | 6.3 |
| redhat | enterprise_linux_server | 5.0 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_workstation | 5.0 |
| redhat | enterprise_linux_workstation | 6.0 |
| canonical | ubuntu_linux | 10.04 |
| canonical | ubuntu_linux | 11.10 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 12.10 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| firefox |
| ||||||||||||||
| seamonkey |
| ||||||||||||||
| thunderbird |
| ||||||||||||||
| xulrunner-1.9.2 |
| ||||||||||||||
| xulrunner-2.0 |
|
References