PT-2012-5949 · Mozilla · Firefox+2

David Bloom + 1 · Publicado 2012-10-10 · Atualizado 2020-08-26 · CVE-2012-5354

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 16.0 Thunderbird versions prior to 16.0 SeaMonkey versions prior to 2.13

Description The issue arises from improper handling of navigation away from a web page with multiple active menus of SELECT elements, allowing remote attackers to conduct clickjacking attacks. This can be achieved through vectors involving an XPI file, the window.open method, and the Geolocation API.

Recommendations For Mozilla Firefox versions prior to 16.0, update to version 16.0 or later. For Thunderbird versions prior to 16.0, update to version 16.0 or later. For SeaMonkey versions prior to 2.13, update to version 2.13 or later.

Correção

Identificadores relacionados

CVE-2012-5354

Produtos afetados

Firefox

Seamonkey

Thunderbird

Referências · 7

• http://mozilla.org/security/announce/2012/mfsa2012-75.html · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16972 · Nota
• http://secunia.com/advisories/50856 · Nota
• http://osvdb.org/86171 · Nota
• http://secunia.com/advisories/50935 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=726264 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5354 · Nota de Segurança