CVE-2012-1963
First published: Wed Jul 18 2012(Updated: )
The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violation report, which allows remote web servers to capture OpenID credentials and OAuth 2.0 access tokens by triggering a violation.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | =4.0 | |
| Firefox | =4.0-beta1 | |
| Firefox | =4.0-beta10 | |
| Firefox | =4.0-beta11 | |
| Firefox | =4.0-beta12 | |
| Firefox | =4.0-beta2 | |
| Firefox | =4.0-beta3 | |
| Firefox | =4.0-beta4 | |
| Firefox | =4.0-beta5 | |
| Firefox | =4.0-beta6 | |
| Firefox | =4.0-beta7 | |
| Firefox | =4.0-beta8 | |
| Firefox | =4.0-beta9 | |
| Firefox | =4.0.1 | |
| Firefox | =5.0 | |
| Firefox | =5.0.1 | |
| Firefox | =6.0 | |
| Firefox | =6.0.1 | |
| Firefox | =6.0.2 | |
| Firefox | =7.0 | |
| Firefox | =7.0.1 | |
| Firefox | =8.0 | |
| Firefox | =8.0.1 | |
| Firefox | =9.0 | |
| Firefox | =9.0.1 | |
| Firefox | =11.0 | |
| Firefox | =12.0 | |
| Firefox | =12.0-beta6 | |
| Firefox | =13.0 | |
| Firefox | =10.0 | |
| Firefox | =10.0.1 | |
| Firefox | =10.0.2 | |
| Firefox | =10.0.3 | |
| Firefox | =10.0.4 | |
| Firefox | =10.0.5 | |
| Thunderbird | =5.0 | |
| Thunderbird | =6.0 | |
| Thunderbird | =6.0.1 | |
| Thunderbird | =6.0.2 | |
| Thunderbird | =7.0 | |
| Thunderbird | =7.0.1 | |
| Thunderbird | =8.0 | |
| Thunderbird | =9.0 | |
| Thunderbird | =9.0.1 | |
| Thunderbird | =10.0 | |
| Thunderbird | =10.0.1 | |
| Thunderbird | =10.0.2 | |
| Thunderbird | =10.0.3 | |
| Thunderbird | =10.0.4 | |
| Thunderbird | =11.0 | |
| Thunderbird | =12.0 | |
| Thunderbird | =13.0 | |
| Mozilla Thunderbird | =10.0 | |
| Mozilla Thunderbird | =10.0.1 | |
| Mozilla Thunderbird | =10.0.2 | |
| Mozilla Thunderbird | =10.0.3 | |
| Mozilla Thunderbird | =10.0.4 | |
| Mozilla Thunderbird | =10.0.5 | |
| Mozilla SeaMonkey | <=2.10 | |
| Mozilla SeaMonkey | =1.0 | |
| Mozilla SeaMonkey | =1.0-alpha | |
| Mozilla SeaMonkey | =1.0-beta | |
| Mozilla SeaMonkey | =1.0.1 | |
| Mozilla SeaMonkey | =1.0.2 | |
| Mozilla SeaMonkey | =1.0.3 | |
| Mozilla SeaMonkey | =1.0.4 | |
| Mozilla SeaMonkey | =1.0.5 | |
| Mozilla SeaMonkey | =1.0.6 | |
| Mozilla SeaMonkey | =1.0.7 | |
| Mozilla SeaMonkey | =1.0.8 | |
| Mozilla SeaMonkey | =1.0.9 | |
| Mozilla SeaMonkey | =1.1 | |
| Mozilla SeaMonkey | =1.1-alpha | |
| Mozilla SeaMonkey | =1.1-beta | |
| Mozilla SeaMonkey | =1.1.1 | |
| Mozilla SeaMonkey | =1.1.2 | |
| Mozilla SeaMonkey | =1.1.3 | |
| Mozilla SeaMonkey | =1.1.4 | |
| Mozilla SeaMonkey | =1.1.5 | |
| Mozilla SeaMonkey | =1.1.6 | |
| Mozilla SeaMonkey | =1.1.7 | |
| Mozilla SeaMonkey | =1.1.8 | |
| Mozilla SeaMonkey | =1.1.9 | |
| Mozilla SeaMonkey | =1.1.10 | |
| Mozilla SeaMonkey | =1.1.11 | |
| Mozilla SeaMonkey | =1.1.12 | |
| Mozilla SeaMonkey | =1.1.13 | |
| Mozilla SeaMonkey | =1.1.14 | |
| Mozilla SeaMonkey | =1.1.15 | |
| Mozilla SeaMonkey | =1.1.16 | |
| Mozilla SeaMonkey | =1.1.17 | |
| Mozilla SeaMonkey | =1.1.18 | |
| Mozilla SeaMonkey | =1.1.19 | |
| Mozilla SeaMonkey | =1.5.0.8 | |
| Mozilla SeaMonkey | =1.5.0.9 | |
| Mozilla SeaMonkey | =1.5.0.10 | |
| Mozilla SeaMonkey | =2.0 | |
| Mozilla SeaMonkey | =2.0-alpha_1 | |
| Mozilla SeaMonkey | =2.0-alpha_2 | |
| Mozilla SeaMonkey | =2.0-alpha_3 | |
| Mozilla SeaMonkey | =2.0-beta_1 | |
| Mozilla SeaMonkey | =2.0-beta_2 | |
| Mozilla SeaMonkey | =2.0-rc1 | |
| Mozilla SeaMonkey | =2.0-rc2 | |
| Mozilla SeaMonkey | =2.0.1 | |
| Mozilla SeaMonkey | =2.0.2 | |
| Mozilla SeaMonkey | =2.0.3 | |
| Mozilla SeaMonkey | =2.0.4 | |
| Mozilla SeaMonkey | =2.0.5 | |
| Mozilla SeaMonkey | =2.0.6 | |
| Mozilla SeaMonkey | =2.0.7 | |
| Mozilla SeaMonkey | =2.0.8 | |
| Mozilla SeaMonkey | =2.0.9 | |
| Mozilla SeaMonkey | =2.0.10 | |
| Mozilla SeaMonkey | =2.0.11 | |
| Mozilla SeaMonkey | =2.0.12 | |
| Mozilla SeaMonkey | =2.0.13 | |
| Mozilla SeaMonkey | =2.0.14 | |
| Mozilla SeaMonkey | =2.1 | |
| Mozilla SeaMonkey | =2.1-alpha1 | |
| Mozilla SeaMonkey | =2.1-alpha2 | |
| Mozilla SeaMonkey | =2.1-alpha3 | |
| Mozilla SeaMonkey | =2.1-beta1 | |
| Mozilla SeaMonkey | =2.1-beta2 | |
| Mozilla SeaMonkey | =2.1-beta3 | |
| Mozilla SeaMonkey | =2.1-rc1 | |
| Mozilla SeaMonkey | =2.1-rc2 | |
| Firefox ESR | =10.0 | |
| Firefox ESR | =10.0.1 | |
| Firefox ESR | =10.0.2 | |
| Firefox ESR | =10.0.3 | |
| Firefox ESR | =10.0.4 | |
| Firefox ESR | =10.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00016.html
- http://osvdb.org/84005
- http://rhn.redhat.com/errata/RHSA-2012-1088.html
- http://secunia.com/advisories/49965
- http://secunia.com/advisories/49968
- http://secunia.com/advisories/49972
- http://secunia.com/advisories/49977
- http://secunia.com/advisories/49979
- http://secunia.com/advisories/49992
- http://secunia.com/advisories/49993
- http://secunia.com/advisories/49994
- http://www.mozilla.org/security/announce/2012/mfsa2012-53.html
- http://www.securityfocus.com/bid/54582
- http://www.securitytracker.com/id?1027256
- http://www.securitytracker.com/id?1027257
- http://www.securitytracker.com/id?1027258
- http://www.ubuntu.com/usn/USN-1509-1
- http://www.ubuntu.com/usn/USN-1509-2
- http://www.ubuntu.com/usn/USN-1510-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=767778
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17056
Frequently Asked Questions
What is the severity of CVE-2012-1963?
CVE-2012-1963 is classified as a moderate severity vulnerability.
How do I fix CVE-2012-1963?
To fix CVE-2012-1963, update your Mozilla Firefox, Thunderbird, or SeaMonkey to the latest version.
Which software is affected by CVE-2012-1963?
CVE-2012-1963 affects Mozilla Firefox versions 4.x through 13.0, Thunderbird versions 5.0 through 13.0, and SeaMonkey versions before 2.11.
When was CVE-2012-1963 disclosed?
CVE-2012-1963 was disclosed in July 2012.
What type of vulnerability is CVE-2012-1963?
CVE-2012-1963 is a vulnerability related to the Content Security Policy functionality.
- agent/references
- agent/type
- agent/weakness
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- agent/author
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/mozilla
- canonical/firefox
- version/firefox/4.0
- version/firefox/4.0-beta1
- version/firefox/4.0-beta10
- version/firefox/4.0-beta11
- version/firefox/4.0-beta12
- version/firefox/4.0-beta2
- version/firefox/4.0-beta3
- version/firefox/4.0-beta4
- version/firefox/4.0-beta5
- version/firefox/4.0-beta6
- version/firefox/4.0-beta7
- version/firefox/4.0-beta8
- version/firefox/4.0-beta9
- version/firefox/4.0.1
- version/firefox/5.0
- version/firefox/5.0.1
- version/firefox/6.0
- version/firefox/6.0.1
- version/firefox/6.0.2
- version/firefox/7.0
- version/firefox/7.0.1
- version/firefox/8.0
- version/firefox/8.0.1
- version/firefox/9.0
- version/firefox/9.0.1
- version/firefox/11.0
- version/firefox/12.0
- version/firefox/12.0-beta6
- version/firefox/13.0
- version/firefox/10.0
- version/firefox/10.0.1
- version/firefox/10.0.2
- version/firefox/10.0.3
- version/firefox/10.0.4
- version/firefox/10.0.5
- canonical/thunderbird
- version/thunderbird/5.0
- version/thunderbird/6.0
- version/thunderbird/6.0.1
- version/thunderbird/6.0.2
- version/thunderbird/7.0
- version/thunderbird/7.0.1
- version/thunderbird/8.0
- version/thunderbird/9.0
- version/thunderbird/9.0.1
- version/thunderbird/10.0
- version/thunderbird/10.0.1
- version/thunderbird/10.0.2
- version/thunderbird/10.0.3
- version/thunderbird/10.0.4
- version/thunderbird/11.0
- version/thunderbird/12.0
- version/thunderbird/13.0
- canonical/mozilla thunderbird
- version/mozilla thunderbird/10.0
- version/mozilla thunderbird/10.0.1
- version/mozilla thunderbird/10.0.2
- version/mozilla thunderbird/10.0.3
- version/mozilla thunderbird/10.0.4
- version/mozilla thunderbird/10.0.5
- canonical/mozilla seamonkey
- version/mozilla seamonkey/2.10
- version/mozilla seamonkey/1.0
- version/mozilla seamonkey/1.0-alpha
- version/mozilla seamonkey/1.0-beta
- version/mozilla seamonkey/1.0.1
- version/mozilla seamonkey/1.0.2
- version/mozilla seamonkey/1.0.3
- version/mozilla seamonkey/1.0.4
- version/mozilla seamonkey/1.0.5
- version/mozilla seamonkey/1.0.6
- version/mozilla seamonkey/1.0.7
- version/mozilla seamonkey/1.0.8
- version/mozilla seamonkey/1.0.9
- version/mozilla seamonkey/1.1
- version/mozilla seamonkey/1.1-alpha
- version/mozilla seamonkey/1.1-beta
- version/mozilla seamonkey/1.1.1
- version/mozilla seamonkey/1.1.2
- version/mozilla seamonkey/1.1.3
- version/mozilla seamonkey/1.1.4
- version/mozilla seamonkey/1.1.5
- version/mozilla seamonkey/1.1.6
- version/mozilla seamonkey/1.1.7
- version/mozilla seamonkey/1.1.8
- version/mozilla seamonkey/1.1.9
- version/mozilla seamonkey/1.1.10
- version/mozilla seamonkey/1.1.11
- version/mozilla seamonkey/1.1.12
- version/mozilla seamonkey/1.1.13
- version/mozilla seamonkey/1.1.14
- version/mozilla seamonkey/1.1.15
- version/mozilla seamonkey/1.1.16
- version/mozilla seamonkey/1.1.17
- version/mozilla seamonkey/1.1.18
- version/mozilla seamonkey/1.1.19
- version/mozilla seamonkey/1.5.0.8
- version/mozilla seamonkey/1.5.0.9
- version/mozilla seamonkey/1.5.0.10
- version/mozilla seamonkey/2.0
- version/mozilla seamonkey/2.0-alpha_1
- version/mozilla seamonkey/2.0-alpha_2
- version/mozilla seamonkey/2.0-alpha_3
- version/mozilla seamonkey/2.0-beta_1
- version/mozilla seamonkey/2.0-beta_2
- version/mozilla seamonkey/2.0-rc1
- version/mozilla seamonkey/2.0-rc2
- version/mozilla seamonkey/2.0.1
- version/mozilla seamonkey/2.0.2
- version/mozilla seamonkey/2.0.3
- version/mozilla seamonkey/2.0.4
- version/mozilla seamonkey/2.0.5
- version/mozilla seamonkey/2.0.6
- version/mozilla seamonkey/2.0.7
- version/mozilla seamonkey/2.0.8
- version/mozilla seamonkey/2.0.9
- version/mozilla seamonkey/2.0.10
- version/mozilla seamonkey/2.0.11
- version/mozilla seamonkey/2.0.12
- version/mozilla seamonkey/2.0.13
- version/mozilla seamonkey/2.0.14
- version/mozilla seamonkey/2.1
- version/mozilla seamonkey/2.1-alpha1
- version/mozilla seamonkey/2.1-alpha2
- version/mozilla seamonkey/2.1-alpha3
- version/mozilla seamonkey/2.1-beta1
- version/mozilla seamonkey/2.1-beta2
- version/mozilla seamonkey/2.1-beta3
- version/mozilla seamonkey/2.1-rc1
- version/mozilla seamonkey/2.1-rc2
- canonical/firefox esr
- version/firefox esr/10.0
- version/firefox esr/10.0.1
- version/firefox esr/10.0.2
- version/firefox esr/10.0.3
- version/firefox esr/10.0.4
- version/firefox esr/10.0.5