Vulnerability Details : CVE-2012-1970
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Products affected by CVE-2012-1970
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
Threat overview for CVE-2012-1970
Top countries where our scanners detected CVE-2012-1970
Top open port discovered on systems with this issue
8200
IPs affected by CVE-2012-1970 2,348
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2012-1970!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2012-1970
2.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 89 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-1970
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2012-1970
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-1970
-
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
[security-announce] SUSE-SU-2012:1167-1: important: Security update forMailing List;Third Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=778765
778765 - crash at [@ libc-2.15.so@0x36445 ] at MapsGL with webgl.msaa-level = 1Issue Tracking;Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16910
Repository / Oval RepositoryThird Party Advisory
-
http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
Third Party Advisory
-
http://www.debian.org/security/2012/dsa-2553
Third Party Advisory
-
http://www.debian.org/security/2012/dsa-2556
Debian -- Security Information -- DSA-2556-1 icedoveThird Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=758408
758408 - "Assertion failure: &obj->getSlotRef(slot) == this,"Issue Tracking;Vendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=764176
764176 - Crash with gradient, hugeness, "-moz-appearance: statusbar"Issue Tracking;Vendor Advisory
-
http://www.debian.org/security/2012/dsa-2554
Debian -- Security Information -- DSA-2554-1 iceapeThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1548-2
USN-1548-2: Firefox regression | Ubuntu security noticesThird Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=761831
761831 - "ASSERTION: obj must be a wrapper" with document.open during DOMNodeRemoved eventIssue Tracking;Vendor Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-1211.html
RHSA-2012:1211 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-1210.html
RHSA-2012:1210 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.mozilla.org/security/announce/2012/mfsa2012-57.html
Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7) — MozillaVendor Advisory
-
http://www.ubuntu.com/usn/USN-1548-1
USN-1548-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=777806
777806 - XHR use-after-free of JSIssue Tracking;Vendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=775206
775206 - Random IndexedDB crashes with Trial ToolIssue Tracking;Vendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=745158
745158 - Crash [@ Decompile] with let expressionsIssue Tracking;Vendor Advisory
-
http://www.securityfocus.com/bid/55266
Mozilla Firefox/Thunderbird/Seamonkey CVE-2012-1970 Multiple Memory Corruption VulnerabilitiesThird Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html
[security-announce] openSUSE-SU-2012:1065-1: critical: MozillaFirefox: UMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html
[security-announce] SUSE-SU-2012:1157-1: important: Security update forMailing List;Third Party Advisory
Jump to