CVE-2012-1965 : Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not prope

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.

Published 2012-07-18 10:26:49

Updated 2024-10-21 13:55:04

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2012-1965

Mozilla » Firefox » Version: 4.0 Update Beta5
cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta3
cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta4
cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta2
cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta7
cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta8
cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta9
cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta1
cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta10
cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta11
cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta6
cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0 Update Beta12
cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0
cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 4.0.1
cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 5.0
cpe:2.3:a:mozilla:firefox:5.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 6.0
cpe:2.3:a:mozilla:firefox:6.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 6.0.1
cpe:2.3:a:mozilla:firefox:6.0.1:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 5.0.1
cpe:2.3:a:mozilla:firefox:5.0.1:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 6.0.2
cpe:2.3:a:mozilla:firefox:6.0.2:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 7.0
cpe:2.3:a:mozilla:firefox:7.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 8.0
cpe:2.3:a:mozilla:firefox:8.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 7.0.1
cpe:2.3:a:mozilla:firefox:7.0.1:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 8.0.1
cpe:2.3:a:mozilla:firefox:8.0.1:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 9.0.1
cpe:2.3:a:mozilla:firefox:9.0.1:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 12.0
cpe:2.3:a:mozilla:firefox:12.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 12.0 Update Beta6
cpe:2.3:a:mozilla:firefox:12.0:beta6:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 9.0
cpe:2.3:a:mozilla:firefox:9.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 10.0.2
cpe:2.3:a:mozilla:firefox:10.0.2:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 10.0
cpe:2.3:a:mozilla:firefox:10.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 10.0.1
cpe:2.3:a:mozilla:firefox:10.0.1:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 11.0
cpe:2.3:a:mozilla:firefox:11.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 13.0
cpe:2.3:a:mozilla:firefox:13.0:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 10.0.5
cpe:2.3:a:mozilla:firefox:10.0.5:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 10.0.4
cpe:2.3:a:mozilla:firefox:10.0.4:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox » Version: 10.0.3
cpe:2.3:a:mozilla:firefox:10.0.3:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2012-1965

EPSS FAQ

0.33%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 70 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-1965

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2012-1965

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-1965

http://www.securityfocus.com/bid/54579

Mozilla Firefox CVE-2012-1965 Cross Site Scripting Vulnerability
http://rhn.redhat.com/errata/RHSA-2012-1088.html

RHSA-2012:1088 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://secunia.com/advisories/49992

Sign in

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html

[security-announce] SUSE-SU-2012:0895-1: important: Security update for

CVEs referencing this url
http://secunia.com/advisories/49972

Sign in

CVEs referencing this url
http://www.ubuntu.com/usn/USN-1509-1

USN-1509-1: Firefox vulnerabilities | Ubuntu security notices

CVEs referencing this url
http://www.mozilla.org/security/announce/2012/mfsa2012-55.html

feed: URLs with an innerURI inherit security context of page — Mozilla
Vendor Advisory
http://www.securitytracker.com/id?1027256

Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code, Spoof Web Sites, Obtain Information, and Conduct Cross-Site Scripting Attacks - SecurityTracker

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html

[security-announce] openSUSE-SU-2012:0899-1: critical: MozillaFirefox to

CVEs referencing this url
http://secunia.com/advisories/49965

Sign in

CVEs referencing this url
http://secunia.com/advisories/49979

CVEs referencing this url
http://www.ubuntu.com/usn/USN-1509-2

USN-1509-2: ubufox update | Ubuntu security notices

CVEs referencing this url
https://bugzilla.mozilla.org/show_bug.cgi?id=758990

758990 - (CVE-2012-1965) Don't allow feed: URLs with an innerURI that inherits the page's security context
http://osvdb.org/84012
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17001

Repository / Oval Repository
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html

[security-announce] SUSE-SU-2012:0896-1: important: Security update for

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2012-1965

Products affected by CVE-2012-1965

Exploit prediction scoring system (EPSS) score for CVE-2012-1965

CVSS scores for CVE-2012-1965

CWE ids for CVE-2012-1965

References for CVE-2012-1965