CVE-2012-0460
First published: Wed Mar 14 2012(Updated: )
Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict write access to the window.fullScreen object, which allows remote attackers to spoof the user interface via a crafted web page.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | =4.0 | |
| Firefox | =4.0-beta1 | |
| Firefox | =4.0-beta10 | |
| Firefox | =4.0-beta11 | |
| Firefox | =4.0-beta12 | |
| Firefox | =4.0-beta2 | |
| Firefox | =4.0-beta3 | |
| Firefox | =4.0-beta4 | |
| Firefox | =4.0-beta5 | |
| Firefox | =4.0-beta6 | |
| Firefox | =4.0-beta7 | |
| Firefox | =4.0-beta8 | |
| Firefox | =4.0-beta9 | |
| Firefox | =4.0.1 | |
| Firefox | =5.0 | |
| Firefox | =5.0.1 | |
| Firefox | =6.0 | |
| Firefox | =6.0.1 | |
| Firefox | =6.0.2 | |
| Firefox | =7.0 | |
| Firefox | =7.0.1 | |
| Firefox | =8.0 | |
| Firefox | =8.0.1 | |
| Firefox | =9.0 | |
| Firefox | =9.0.1 | |
| Firefox | =10.0 | |
| Firefox ESR | =10.1 | |
| Firefox ESR | =10.2 | |
| Thunderbird | =5.0 | |
| Thunderbird | =6.0 | |
| Thunderbird | =6.0.1 | |
| Thunderbird | =6.0.2 | |
| Thunderbird | =7.0 | |
| Thunderbird | =7.0.1 | |
| Thunderbird | =8.0 | |
| Thunderbird | =9.0 | |
| Thunderbird | =9.0.1 | |
| Mozilla Thunderbird | =10.0 | |
| Mozilla Thunderbird | =10.0.1 | |
| Mozilla Thunderbird | =10.0.2 | |
| Mozilla SeaMonkey | <=2.7 | |
| Mozilla SeaMonkey | =1.0 | |
| Mozilla SeaMonkey | =1.0-alpha | |
| Mozilla SeaMonkey | =1.0-beta | |
| Mozilla SeaMonkey | =1.0.1 | |
| Mozilla SeaMonkey | =1.0.2 | |
| Mozilla SeaMonkey | =1.0.3 | |
| Mozilla SeaMonkey | =1.0.4 | |
| Mozilla SeaMonkey | =1.0.5 | |
| Mozilla SeaMonkey | =1.0.6 | |
| Mozilla SeaMonkey | =1.0.7 | |
| Mozilla SeaMonkey | =1.0.8 | |
| Mozilla SeaMonkey | =1.0.9 | |
| Mozilla SeaMonkey | =1.1 | |
| Mozilla SeaMonkey | =1.1-alpha | |
| Mozilla SeaMonkey | =1.1-beta | |
| Mozilla SeaMonkey | =1.1.1 | |
| Mozilla SeaMonkey | =1.1.2 | |
| Mozilla SeaMonkey | =1.1.3 | |
| Mozilla SeaMonkey | =1.1.4 | |
| Mozilla SeaMonkey | =1.1.5 | |
| Mozilla SeaMonkey | =1.1.6 | |
| Mozilla SeaMonkey | =1.1.7 | |
| Mozilla SeaMonkey | =1.1.8 | |
| Mozilla SeaMonkey | =1.1.9 | |
| Mozilla SeaMonkey | =1.1.10 | |
| Mozilla SeaMonkey | =1.1.11 | |
| Mozilla SeaMonkey | =1.1.12 | |
| Mozilla SeaMonkey | =1.1.13 | |
| Mozilla SeaMonkey | =1.1.14 | |
| Mozilla SeaMonkey | =1.1.15 | |
| Mozilla SeaMonkey | =1.1.16 | |
| Mozilla SeaMonkey | =1.1.17 | |
| Mozilla SeaMonkey | =1.1.18 | |
| Mozilla SeaMonkey | =1.1.19 | |
| Mozilla SeaMonkey | =1.5.0.8 | |
| Mozilla SeaMonkey | =1.5.0.9 | |
| Mozilla SeaMonkey | =1.5.0.10 | |
| Mozilla SeaMonkey | =2.0 | |
| Mozilla SeaMonkey | =2.0-alpha_1 | |
| Mozilla SeaMonkey | =2.0-alpha_2 | |
| Mozilla SeaMonkey | =2.0-alpha_3 | |
| Mozilla SeaMonkey | =2.0-beta_1 | |
| Mozilla SeaMonkey | =2.0-beta_2 | |
| Mozilla SeaMonkey | =2.0-rc1 | |
| Mozilla SeaMonkey | =2.0-rc2 | |
| Mozilla SeaMonkey | =2.0.1 | |
| Mozilla SeaMonkey | =2.0.2 | |
| Mozilla SeaMonkey | =2.0.3 | |
| Mozilla SeaMonkey | =2.0.4 | |
| Mozilla SeaMonkey | =2.0.5 | |
| Mozilla SeaMonkey | =2.0.6 | |
| Mozilla SeaMonkey | =2.0.7 | |
| Mozilla SeaMonkey | =2.0.8 | |
| Mozilla SeaMonkey | =2.0.9 | |
| Mozilla SeaMonkey | =2.0.10 | |
| Mozilla SeaMonkey | =2.0.11 | |
| Mozilla SeaMonkey | =2.0.12 | |
| Mozilla SeaMonkey | =2.0.13 | |
| Mozilla SeaMonkey | =2.0.14 | |
| Mozilla SeaMonkey | =2.1 | |
| Mozilla SeaMonkey | =2.1-alpha1 | |
| Mozilla SeaMonkey | =2.1-alpha2 | |
| Mozilla SeaMonkey | =2.1-alpha3 | |
| Mozilla SeaMonkey | =2.1-beta1 | |
| Mozilla SeaMonkey | =2.1-beta2 | |
| Mozilla SeaMonkey | =2.1-beta3 | |
| Mozilla SeaMonkey | =2.1-rc1 | |
| Mozilla SeaMonkey | =2.1-rc2 | |
| Mozilla SeaMonkey | =2.2 | |
| Mozilla SeaMonkey | =2.2-beta1 | |
| Mozilla SeaMonkey | =2.2-beta2 | |
| Mozilla SeaMonkey | =2.2-beta3 | |
| Mozilla SeaMonkey | =2.3 | |
| Mozilla SeaMonkey | =2.3-beta1 | |
| Mozilla SeaMonkey | =2.3-beta2 | |
| Mozilla SeaMonkey | =2.3-beta3 | |
| Mozilla SeaMonkey | =2.3.1 | |
| Mozilla SeaMonkey | =2.3.2 | |
| Mozilla SeaMonkey | =2.3.3 | |
| Mozilla SeaMonkey | =2.4 | |
| Mozilla SeaMonkey | =2.4-beta1 | |
| Mozilla SeaMonkey | =2.4-beta2 | |
| Mozilla SeaMonkey | =2.4-beta3 | |
| Mozilla SeaMonkey | =2.4.1 | |
| Mozilla SeaMonkey | =2.5 | |
| Mozilla SeaMonkey | =2.5-beta1 | |
| Mozilla SeaMonkey | =2.5-beta2 | |
| Mozilla SeaMonkey | =2.5-beta3 | |
| Mozilla SeaMonkey | =2.5-beta4 | |
| Mozilla SeaMonkey | =2.6 | |
| Mozilla SeaMonkey | =2.6-beta1 | |
| Mozilla SeaMonkey | =2.6-beta2 | |
| Mozilla SeaMonkey | =2.6-beta3 | |
| Mozilla SeaMonkey | =2.6-beta4 | |
| Mozilla SeaMonkey | =2.6.1 | |
| Mozilla SeaMonkey | =2.7-beta1 | |
| Mozilla SeaMonkey | =2.7-beta2 | |
| Mozilla SeaMonkey | =2.7-beta3 | |
| Mozilla SeaMonkey | =2.7-beta4 | |
| Firefox ESR | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
- http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
- http://rhn.redhat.com/errata/RHSA-2012-0387.html
- http://rhn.redhat.com/errata/RHSA-2012-0388.html
- http://secunia.com/advisories/48359
- http://secunia.com/advisories/48402
- http://secunia.com/advisories/48496
- http://secunia.com/advisories/48513
- http://secunia.com/advisories/48553
- http://secunia.com/advisories/48561
- http://secunia.com/advisories/48629
- http://secunia.com/advisories/49055
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:032
- http://www.mozilla.org/security/announce/2012/mfsa2012-18.html
- http://www.securitytracker.com/id?1026801
- http://www.securitytracker.com/id?1026803
- http://www.securitytracker.com/id?1026804
- http://www.ubuntu.com/usn/USN-1400-1
- http://www.ubuntu.com/usn/USN-1400-2
- http://www.ubuntu.com/usn/USN-1400-3
- http://www.ubuntu.com/usn/USN-1400-4
- http://www.ubuntu.com/usn/USN-1400-5
- https://bugzilla.mozilla.org/show_bug.cgi?id=727303
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15114
Frequently Asked Questions
What is the severity of CVE-2012-0460?
CVE-2012-0460 has a medium severity rating due to its potential for UI spoofing.
How do I fix CVE-2012-0460?
To fix CVE-2012-0460, upgrade your Mozilla Firefox, Thunderbird, or SeaMonkey application to the latest version that addresses this vulnerability.
Which versions are affected by CVE-2012-0460?
CVE-2012-0460 affects Mozilla Firefox versions 4.x to 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8.
What type of vulnerability is CVE-2012-0460?
CVE-2012-0460 is a UI spoofing vulnerability that allows attackers to manipulate the user interface via the window.fullScreen object.
Who is primarily affected by CVE-2012-0460?
Users of Mozilla Firefox, Thunderbird, and SeaMonkey versions outlined in the CVE-2012-0460 report are primarily affected.
- agent/references
- agent/type
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/author
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/mozilla
- canonical/firefox
- version/firefox/4.0
- version/firefox/4.0-beta1
- version/firefox/4.0-beta10
- version/firefox/4.0-beta11
- version/firefox/4.0-beta12
- version/firefox/4.0-beta2
- version/firefox/4.0-beta3
- version/firefox/4.0-beta4
- version/firefox/4.0-beta5
- version/firefox/4.0-beta6
- version/firefox/4.0-beta7
- version/firefox/4.0-beta8
- version/firefox/4.0-beta9
- version/firefox/4.0.1
- version/firefox/5.0
- version/firefox/5.0.1
- version/firefox/6.0
- version/firefox/6.0.1
- version/firefox/6.0.2
- version/firefox/7.0
- version/firefox/7.0.1
- version/firefox/8.0
- version/firefox/8.0.1
- version/firefox/9.0
- version/firefox/9.0.1
- version/firefox/10.0
- canonical/firefox esr
- version/firefox esr/10.1
- version/firefox esr/10.2
- canonical/thunderbird
- version/thunderbird/5.0
- version/thunderbird/6.0
- version/thunderbird/6.0.1
- version/thunderbird/6.0.2
- version/thunderbird/7.0
- version/thunderbird/7.0.1
- version/thunderbird/8.0
- version/thunderbird/9.0
- version/thunderbird/9.0.1
- canonical/mozilla thunderbird
- version/mozilla thunderbird/10.0
- version/mozilla thunderbird/10.0.1
- version/mozilla thunderbird/10.0.2
- canonical/mozilla seamonkey
- version/mozilla seamonkey/2.7
- version/mozilla seamonkey/1.0
- version/mozilla seamonkey/1.0-alpha
- version/mozilla seamonkey/1.0-beta
- version/mozilla seamonkey/1.0.1
- version/mozilla seamonkey/1.0.2
- version/mozilla seamonkey/1.0.3
- version/mozilla seamonkey/1.0.4
- version/mozilla seamonkey/1.0.5
- version/mozilla seamonkey/1.0.6
- version/mozilla seamonkey/1.0.7
- version/mozilla seamonkey/1.0.8
- version/mozilla seamonkey/1.0.9
- version/mozilla seamonkey/1.1
- version/mozilla seamonkey/1.1-alpha
- version/mozilla seamonkey/1.1-beta
- version/mozilla seamonkey/1.1.1
- version/mozilla seamonkey/1.1.2
- version/mozilla seamonkey/1.1.3
- version/mozilla seamonkey/1.1.4
- version/mozilla seamonkey/1.1.5
- version/mozilla seamonkey/1.1.6
- version/mozilla seamonkey/1.1.7
- version/mozilla seamonkey/1.1.8
- version/mozilla seamonkey/1.1.9
- version/mozilla seamonkey/1.1.10
- version/mozilla seamonkey/1.1.11
- version/mozilla seamonkey/1.1.12
- version/mozilla seamonkey/1.1.13
- version/mozilla seamonkey/1.1.14
- version/mozilla seamonkey/1.1.15
- version/mozilla seamonkey/1.1.16
- version/mozilla seamonkey/1.1.17
- version/mozilla seamonkey/1.1.18
- version/mozilla seamonkey/1.1.19
- version/mozilla seamonkey/1.5.0.8
- version/mozilla seamonkey/1.5.0.9
- version/mozilla seamonkey/1.5.0.10
- version/mozilla seamonkey/2.0
- version/mozilla seamonkey/2.0-alpha_1
- version/mozilla seamonkey/2.0-alpha_2
- version/mozilla seamonkey/2.0-alpha_3
- version/mozilla seamonkey/2.0-beta_1
- version/mozilla seamonkey/2.0-beta_2
- version/mozilla seamonkey/2.0-rc1
- version/mozilla seamonkey/2.0-rc2
- version/mozilla seamonkey/2.0.1
- version/mozilla seamonkey/2.0.2
- version/mozilla seamonkey/2.0.3
- version/mozilla seamonkey/2.0.4
- version/mozilla seamonkey/2.0.5
- version/mozilla seamonkey/2.0.6
- version/mozilla seamonkey/2.0.7
- version/mozilla seamonkey/2.0.8
- version/mozilla seamonkey/2.0.9
- version/mozilla seamonkey/2.0.10
- version/mozilla seamonkey/2.0.11
- version/mozilla seamonkey/2.0.12
- version/mozilla seamonkey/2.0.13
- version/mozilla seamonkey/2.0.14
- version/mozilla seamonkey/2.1
- version/mozilla seamonkey/2.1-alpha1
- version/mozilla seamonkey/2.1-alpha2
- version/mozilla seamonkey/2.1-alpha3
- version/mozilla seamonkey/2.1-beta1
- version/mozilla seamonkey/2.1-beta2
- version/mozilla seamonkey/2.1-beta3
- version/mozilla seamonkey/2.1-rc1
- version/mozilla seamonkey/2.1-rc2
- version/mozilla seamonkey/2.2
- version/mozilla seamonkey/2.2-beta1
- version/mozilla seamonkey/2.2-beta2
- version/mozilla seamonkey/2.2-beta3
- version/mozilla seamonkey/2.3
- version/mozilla seamonkey/2.3-beta1
- version/mozilla seamonkey/2.3-beta2
- version/mozilla seamonkey/2.3-beta3
- version/mozilla seamonkey/2.3.1
- version/mozilla seamonkey/2.3.2
- version/mozilla seamonkey/2.3.3
- version/mozilla seamonkey/2.4
- version/mozilla seamonkey/2.4-beta1
- version/mozilla seamonkey/2.4-beta2
- version/mozilla seamonkey/2.4-beta3
- version/mozilla seamonkey/2.4.1
- version/mozilla seamonkey/2.5
- version/mozilla seamonkey/2.5-beta1
- version/mozilla seamonkey/2.5-beta2
- version/mozilla seamonkey/2.5-beta3
- version/mozilla seamonkey/2.5-beta4
- version/mozilla seamonkey/2.6
- version/mozilla seamonkey/2.6-beta1
- version/mozilla seamonkey/2.6-beta2
- version/mozilla seamonkey/2.6-beta3
- version/mozilla seamonkey/2.6-beta4
- version/mozilla seamonkey/2.6.1
- version/mozilla seamonkey/2.7-beta1
- version/mozilla seamonkey/2.7-beta2
- version/mozilla seamonkey/2.7-beta3
- version/mozilla seamonkey/2.7-beta4
- version/firefox esr/10.0