CVE-2012-4195: XSS
The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4195?
CVE-2012-4195 is classified as a high severity vulnerability that can allow attackers to execute arbitrary code.
How do I fix CVE-2012-4195?
To fix CVE-2012-4195, update your Mozilla Firefox, Thunderbird, or SeaMonkey to the latest version available.
Which software is affected by CVE-2012-4195?
CVE-2012-4195 affects Mozilla Firefox versions before 16.0.2, Thunderbird before 16.0.2, and SeaMonkey before 2.13.2.
What type of vulnerability is CVE-2012-4195?
CVE-2012-4195 is a security vulnerability related to improper URL handling in Mozilla applications.
Is there any workaround for CVE-2012-4195 if I cannot update?
A workaround for CVE-2012-4195 is not recommended; the best solution is to apply the available updates as soon as possible.