CVE-2012-1965: XSS
Published Jul 18, 2012
·Updated
Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.
Affected Software
41 affected components
Mozilla Firefox=4.0
Mozilla Firefox=4.0-beta1
Mozilla Firefox=4.0-beta10
Mozilla Firefox=4.0-beta11
Mozilla Firefox=4.0-beta12
Mozilla Firefox=4.0-beta2
Mozilla Firefox=4.0-beta3
Mozilla Firefox=4.0-beta4
Mozilla Firefox=4.0-beta5
Mozilla Firefox=4.0-beta6
Mozilla Firefox=4.0-beta7
Mozilla Firefox=4.0-beta8
Mozilla Firefox=4.0-beta9
Mozilla Firefox=4.0.1
Mozilla Firefox=5.0
Mozilla Firefox=5.0.1
Mozilla Firefox=6.0
Mozilla Firefox=6.0.1
Mozilla Firefox=6.0.2
Mozilla Firefox=7.0
Mozilla Firefox=7.0.1
Mozilla Firefox=8.0
Mozilla Firefox=8.0.1
Mozilla Firefox=9.0
Mozilla Firefox=9.0.1
Mozilla Firefox=11.0
Mozilla Firefox=12.0
Mozilla Firefox=12.0-beta6
Mozilla Firefox=13.0
Mozilla Firefox=10.0
Mozilla Firefox=10.0.1
Mozilla Firefox=10.0.2
Mozilla Firefox=10.0.3
Mozilla Firefox=10.0.4
Mozilla Firefox=10.0.5
Mozilla Firefox ESR=10.0
Mozilla Firefox ESR=10.0.1
Mozilla Firefox ESR=10.0.2
Mozilla Firefox ESR=10.0.3
Mozilla Firefox ESR=10.0.4
Mozilla Firefox ESR=10.0.5
Event History
Jul 18, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-1965?
CVE-2012-1965 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2012-1965?
To fix CVE-2012-1965, upgrade to Firefox version 13.0 or later or Firefox ESR 10.0.6 or later.
3
What type of vulnerability is CVE-2012-1965?
CVE-2012-1965 is a cross-site scripting (XSS) vulnerability related to the handling of feed: URLs in Mozilla Firefox.
4
What versions of Firefox are affected by CVE-2012-1965?
CVE-2012-1965 affects Mozilla Firefox versions 4.x through 13.0 and Firefox ESR versions before 10.0.6.
5
Can CVE-2012-1965 be exploited remotely?
Yes, CVE-2012-1965 can be exploited by remote attackers to bypass XSS protections.