Vulnerability Details : CVE-2012-0458
Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict setting the home page through the dragging of a URL to the home button, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a javascript: URL that is later interpreted in the about:sessionrestore context.
Products affected by CVE-2012-0458
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:10.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:10.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:alpha1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.19:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:alpha2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.18:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:alpha3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.5:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.5:beta3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.4:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.6:beta4:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.2:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.3:beta2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.6:beta2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.6:beta3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.2:beta3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:beta2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:beta3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.5:beta4:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.3:beta3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7:beta4:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7:beta5:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7:beta2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7:beta3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.3:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.2:beta2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.5:beta2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.6:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.4:beta3:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.4:beta2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:-:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:10.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:10.0.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-0458
1.93%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 88 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-0458
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2012-0458
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-0458
-
http://rhn.redhat.com/errata/RHSA-2012-0387.html
RHSA-2012:0387 - Security Advisory - Red Hat Customer Portal
-
https://bugzilla.mozilla.org/show_bug.cgi?id=723808
723808 - disallow inheriting of system principal in type=content docshellsPatch;Issue Tracking;Vendor Advisory
-
http://www.ubuntu.com/usn/USN-1400-4
USN-1400-4: Thunderbird regressions | Ubuntu security noticesThird Party Advisory
-
http://secunia.com/advisories/48920
Sign inThird Party Advisory
-
http://www.mozilla.org/security/announce/2012/mfsa2012-16.html
Escalation of privilege with Javascript: URL as home page — MozillaVendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
[security-announce] SUSE-SU-2012:0424-1: critical: Security update for M
-
http://secunia.com/advisories/48495
Sign inThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1400-2
USN-1400-2: ubufox update | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1400-3
USN-1400-3: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.securitytracker.com/id?1026803
Mozilla Seamonkey Multiple Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks - SecurityTracker
-
http://www.securitytracker.com/id?1026804
Mozilla Thunderbird Multiple Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks - SecurityTracker
-
http://www.securityfocus.com/bid/52460
Mozilla Firefox/SeaMonkey/Thunderbird CVE-2012-0458 Security Bypass Vulnerability
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:032
mandriva.com
-
https://bugzilla.mozilla.org/show_bug.cgi?id=719994
719994 - (CVE-2012-0458) loads of principal-inheriting URIs (e.g. javascript:) on chrome-privileged pages (e.g. about:sessionstore) allows unexpected privilege escalationIssue Tracking;Vendor Advisory
-
http://secunia.com/advisories/48553
Sign inThird Party Advisory
-
http://secunia.com/advisories/48823
Sign inThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
[security-announce] SUSE-SU-2012:0425-1: critical: Security update for M
-
http://www.ubuntu.com/usn/USN-1400-5
USN-1400-5: GSettings desktop schemas regression | Ubuntu security noticesThird Party Advisory
-
http://secunia.com/advisories/48496
Sign inThird Party Advisory
-
http://secunia.com/advisories/48414
Sign in
-
http://secunia.com/advisories/48359
Sign in
-
https://bugzilla.mozilla.org/show_bug.cgi?id=718203
718203 - prevent self-XSS in homepage icon (disallow javascript: drops)Exploit;Issue Tracking;Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-0388.html
RHSA-2012:0388 - Security Advisory - Red Hat Customer Portal
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:031
mandriva.com
-
http://secunia.com/advisories/48561
Runtime ErrorThird Party Advisory
-
http://secunia.com/advisories/48629
Sign inThird Party Advisory
-
http://secunia.com/advisories/48402
Sign in
-
http://www.ubuntu.com/usn/USN-1401-1
USN-1401-1: Xulrunner vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
openSUSE-SU-2012:0417-1: moderate: update for MozillaFirefox, MozillaThuThird Party Advisory
-
http://www.securitytracker.com/id?1026801
Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks - SecurityTracker
-
http://secunia.com/advisories/48624
Sign inThird Party Advisory
-
http://www.debian.org/security/2012/dsa-2433
Debian -- Security Information -- DSA-2433-1 iceweaselThird Party Advisory
-
http://secunia.com/advisories/48513
Sign inThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1400-1
USN-1400-1: Firefox vulnerabilities | Ubuntu security notices
-
http://www.debian.org/security/2012/dsa-2458
Debian -- Security Information -- DSA-2458-2 iceape
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15122
Repository / Oval RepositoryThird Party Advisory
Jump to