Vulnerability CVE-2012-3993
Published: 2012-10-10

Description:
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue.

See advisories in our WLB2 database:
Topic
Author
Date
High
Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution
joev
23.12.2013

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Mozilla -> Firefox 
Mozilla -> Firefox esr 
Mozilla -> Seamonkey 
Mozilla -> Thunderbird 
Mozilla -> Thunderbird esr 

 References:
https://bugzilla.mozilla.org/show_bug.cgi?id=768101
http://xforce.iss.net/xforce/xfdb/79153
http://www.ubuntu.com/usn/USN-1611-1
http://www.securityfocus.com/bid/56119
http://www.mozilla.org/security/announce/2012/mfsa2012-83.html
http://rhn.redhat.com/errata/RHSA-2012-1351.html
http://osvdb.org/86111
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html
Copyright 2024, cxsecurity.com

 

Back to Top