CVE-2012-4208: Infoleak
First published: Wed Nov 21 2012(Updated: )
The XrayWrapper implementation in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 does not consider the compartment during property filtering, which allows remote attackers to bypass intended chrome-only restrictions on reading DOM object properties via a crafted web site.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <17.0 | |
| Mozilla SeaMonkey | <2.14 | |
| Thunderbird | <17.0 | |
| openSUSE | =11.4 | |
| openSUSE | =12.1 | |
| openSUSE | =12.2 | |
| SUSE Linux Enterprise Desktop | =10-sp4 | |
| SUSE Linux Enterprise Desktop | =11-sp2 | |
| SUSE Linux Enterprise Server | =10-sp4 | |
| SUSE Linux Enterprise Server | =11-sp2 | |
| SUSE Linux Enterprise Server | =11-sp2 | |
| SUSE Linux Enterprise Software Development Kit | =10-sp4 | |
| SUSE Linux Enterprise Software Development Kit | =11-sp2 | |
| Ubuntu | =10.04 | |
| Ubuntu | =11.10 | |
| Ubuntu | =12.04 | |
| Ubuntu | =12.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html
- http://secunia.com/advisories/51369
- http://secunia.com/advisories/51370
- http://secunia.com/advisories/51381
- http://secunia.com/advisories/51434
- http://secunia.com/advisories/51439
- http://secunia.com/advisories/51440
- http://www.mozilla.org/security/announce/2012/mfsa2012-99.html
- http://www.securityfocus.com/bid/56627
- http://www.ubuntu.com/usn/USN-1636-1
- http://www.ubuntu.com/usn/USN-1638-1
- http://www.ubuntu.com/usn/USN-1638-2
- http://www.ubuntu.com/usn/USN-1638-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=798264
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16695
Frequently Asked Questions
What is the severity of CVE-2012-4208?
CVE-2012-4208 is rated as a moderate severity vulnerability.
How do I fix CVE-2012-4208?
To fix CVE-2012-4208, update your Mozilla Firefox, Thunderbird, or SeaMonkey to the latest version available.
Who is affected by CVE-2012-4208?
CVE-2012-4208 affects Mozilla Firefox versions before 17.0, Thunderbird versions before 17.0, and SeaMonkey versions before 2.14.
What type of vulnerability is CVE-2012-4208?
CVE-2012-4208 is a DOM property filtering bypass vulnerability.
What can a remote attacker do using CVE-2012-4208?
A remote attacker can exploit CVE-2012-4208 to bypass chrome-only restrictions on reading DOM object properties.
- agent/type
- agent/weakness
- agent/severity
- agent/author
- agent/remedy
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mozilla
- canonical/firefox
- canonical/mozilla seamonkey
- canonical/thunderbird
- vendor/opensuse
- canonical/opensuse
- version/opensuse/11.4
- version/opensuse/12.1
- version/opensuse/12.2
- vendor/suse
- canonical/suse linux enterprise desktop
- version/suse linux enterprise desktop/10-sp4
- version/suse linux enterprise desktop/11-sp2
- canonical/suse linux enterprise server
- version/suse linux enterprise server/10-sp4
- version/suse linux enterprise server/11-sp2
- canonical/suse linux enterprise software development kit
- version/suse linux enterprise software development kit/10-sp4
- version/suse linux enterprise software development kit/11-sp2
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/10.04
- version/ubuntu/11.10
- version/ubuntu/12.04
- version/ubuntu/12.10