Vulnerability Details : CVE-2012-4207
The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly handle a ~ (tilde) character in proximity to a chunk delimiter, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2012-4207
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-4207
0.82%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 82 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-4207
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2012-4207
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-4207
-
http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html
openSUSE-SU-2012:1586-1: moderate: update for xulrunnerMailing List;Third Party Advisory
-
http://secunia.com/advisories/51360
Sign inThird Party Advisory
-
http://secunia.com/advisories/51370
Sign inThird Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html
openSUSE-SU-2012:1585-1: moderate: update for MozillaThunderbirdMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
openSUSE-SU-2012:1583-1: moderate: update for MozillaFirefoxMailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/56632
Mozilla Firefox, SeaMonkey, and Thunderbird HZ-GB-2312 Cross Site Scripting VulnerabilityThird Party Advisory;VDB Entry
-
http://www.ubuntu.com/usn/USN-1638-3
USN-1638-3: Firefox regressions | Ubuntu security noticesThird Party Advisory
-
http://secunia.com/advisories/51359
Sign inThird Party Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16955
Repository / Oval RepositoryThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html
[security-announce] SUSE-SU-2012:1592-1: important: Security update forMailing List;Third Party Advisory
-
http://www.ubuntu.com/usn/USN-1638-1
USN-1638-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1638-2
USN-1638-2: ubufox update | Ubuntu security noticesThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-1482.html
RHSA-2012:1482 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.palemoon.org/releasenotes-ng.shtml
Pale Moon -Broken Link
-
http://secunia.com/advisories/51439
Sign inThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-1483.html
RHSA-2012:1483 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://secunia.com/advisories/51381
Sign inThird Party Advisory
-
http://secunia.com/advisories/51369
Sign inThird Party Advisory
-
http://www.mozilla.org/security/announce/2012/mfsa2012-101.html
Improper character decoding in HZ-GB-2312 charset — MozillaVendor Advisory
-
http://osvdb.org/87587
Broken Link
-
http://www.debian.org/security/2012/dsa-2583
Debian -- Security Information -- DSA-2583-1 iceweaselThird Party Advisory
-
http://secunia.com/advisories/51434
Sign inThird Party Advisory
-
http://secunia.com/advisories/51440
Sign inThird Party Advisory
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:173
mandriva.comThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1636-1
USN-1636-1: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=801681
801681 - (CVE-2012-4207) "~" eats a char near chunk delimiter in HZ-GB-2312 encodingExploit;Issue Tracking;Patch;Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html
[security-announce] openSUSE-SU-2013:0175-1: important: security updateMailing List;Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/80179
Mozilla Firefox, Thunderbird, and SeaMonkey HZ-GB-2312 cross-site scripting CVE-2012-4207 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://www.debian.org/security/2012/dsa-2588
Debian -- Security Information -- DSA-2588-1 icedoveThird Party Advisory
-
http://www.debian.org/security/2012/dsa-2584
Debian -- Security Information -- DSA-2584-1 iceapeThird Party Advisory
Jump to