CVE-2012-4201: XSS
The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4201?
CVE-2012-4201 has a moderate severity level as it can lead to security issues in affected versions of Mozilla products.
How do I fix CVE-2012-4201?
To fix CVE-2012-4201, update your Mozilla Firefox, Thunderbird, or SeaMonkey to the latest version.
Which versions of Mozilla products are affected by CVE-2012-4201?
CVE-2012-4201 affects Mozilla Firefox prior to version 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14.
Can CVE-2012-4201 be exploited remotely?
Yes, CVE-2012-4201 can potentially be exploited remotely through crafted JavaScript code.
What types of systems are impacted by CVE-2012-4201?
CVE-2012-4201 impacts multiple operating systems including openSUSE, Ubuntu, Red Hat, and Debian running affected versions of Mozilla software.