CVE-2012-4194: XSS
Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4194?
The severity of CVE-2012-4194 is generally considered to be moderate, as it can lead to information disclosure if exploited.
How do I fix CVE-2012-4194?
To fix CVE-2012-4194, update your Mozilla Firefox, Thunderbird, and SeaMonkey to versions 16.0.2 or higher respectively.
Which versions of Firefox are affected by CVE-2012-4194?
CVE-2012-4194 affects Firefox versions prior to 16.0.2 and Firefox ESR versions before 10.0.10.
Is Thunderbird also affected by CVE-2012-4194?
Yes, Thunderbird versions before 16.0.2 and Thunderbird ESR versions prior to 10.0.10 are affected by CVE-2012-4194.
Can CVE-2012-4194 be exploited remotely?
Yes, CVE-2012-4194 can be exploited remotely, making it a concern for users of affected software.