Skip to content
OpenAdvisories
Unscored CVE-2012-4209 EUVD-2012-4153GHSA-mc6f-7xm8-q752

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey b…

Published Nov 21, 2012 · Updated Aug 6, 2024 · Assigned by mitre

Description

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the location property, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a binary plugin.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 firefox +3 10.0.11-1.el6_3 RHSA-2012:1483, RHSA-2012:1482
RHEL 5 firefox +3 10.0.11-1.el5_8 RHSA-2012:1483, RHSA-2012:1482
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Productivity 5 thunderbird 10.0.11-1.el5_8 RHSA-2012:1483

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 50.1.0-1.1 openSUSE-SU-2024:10071-1
openSUSE Tumbleweed MozillaThunderbird 45.5.1-1.1 openSUSE-SU-2024:10230-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 5

References