PT-2012-2576 · Mozilla+3 · Firefox+7

Soroush Dalili · Publicado 2012-03-13 · Atualizado 2024-12-12 · CVE-2012-0455

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 10.0 Mozilla Firefox version 3.6.28 and earlier Firefox ESR versions 10.x through 10.0.2 Thunderbird versions 5.0 through 10.0 Thunderbird version 3.1.20 and earlier Thunderbird ESR versions 10.x through 10.0.2 SeaMonkey version 2.8 and earlier

Description The issue allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue, due to improper restriction of drag-and-drop operations on javascript: URLs.

Recommendations For Mozilla Firefox versions 4.x through 10.0, update to a version after 10.0. For Mozilla Firefox version 3.6.28 and earlier, update to a version after 3.6.28. For Firefox ESR versions 10.x through 10.0.2, update to version 10.0.3 or later. For Thunderbird versions 5.0 through 10.0, update to a version after 10.0. For Thunderbird version 3.1.20 and earlier, update to a version after 3.1.20. For Thunderbird ESR versions 10.x through 10.0.2, update to version 10.0.3 or later. For SeaMonkey version 2.8 and earlier, update to a version after 2.8.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CESA-2012_0387

CESA-2012_0388

CVE-2012-0455

DSA-2433-1

DSA-2437-1

DSA-2458-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:14572-1

RHSA-2012:0387

RHSA-2012:0388

RHSA-2012_0387

RHSA-2012_0388

Produtos afetados

Centos

Firefox Esr

Firefox

Red Hat

Seamonkey

Suse

Thunderbird

Thunderbird Esr

Referências · 3145

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://suse.com/security/cve/CVE-2009-0354 · Nota