PT-2012-2575 · Mozilla+2 · Firefox+6

Blair Strang + 1 · Publicado 2012-03-13 · Atualizado 2024-10-21 · CVE-2012-0454

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 10.0 Firefox ESR versions 10.x before 10.0.3 Thunderbird versions 5.0 through 10.0 Thunderbird ESR versions 10.x before 10.0.3 SeaMonkey version before 2.8

Description The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors involving use of the file-open dialog in a child window, related to the IUnknown QueryService function in the Windows shlwapi.dll library.

Recommendations For Mozilla Firefox versions 4.x through 10.0, update to a version after 10.0. For Firefox ESR versions 10.x before 10.0.3, update to version 10.0.3 or later. For Thunderbird versions 5.0 through 10.0, update to a version after 10.0. For Thunderbird ESR versions 10.x before 10.0.3, update to version 10.0.3 or later. For SeaMonkey version before 2.8, update to version 2.8 or later.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2012-0454

Produtos afetados

Firefox Esr

Firefox

Seamonkey

Suse

Thunderbird

Thunderbird Esr

Shlwapi.Dll

Referências · 15

• http://securitytracker.com/id?1026803 · Nota
• http://secunia.com/advisories/48402 · Nota
• http://securitytracker.com/id?1026801 · Nota
• http://secunia.com/advisories/48629 · Nota
• https://t.me/cvenotify/98937 · Publicação no Telegram
• http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2012:032 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-0454 · Nota de Segurança
• http://secunia.com/advisories/48561 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=684555 · Nota
• http://securitytracker.com/id?1026804 · Nota
• https://mozilla.org/en-US/security/advisories/mfsa2012-12 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0454 · Nota de Segurança
• http://mozilla.org/security/announce/2012/mfsa2012-12.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14258 · Nota