PT-2012-2563 · Mozilla+3 · Firefox+8

Kaspar · Published 2012-06-05 · Updated 2024-12-12 · CVE-2012-0441

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services (NSS) versions prior to 3.13.4 Firefox versions 4.x through 12.0 Firefox ESR versions 10.x prior to 10.0.5 Thunderbird versions 5.0 through 12.0 Thunderbird ESR versions 10.x prior to 10.0.5 SeaMonkey versions prior to 2.10

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, via a zero-length item. This can be demonstrated by a zero-length basic constraint or a zero-length field in an OCSP response.

Recommendations For Mozilla Network Security Services (NSS) versions prior to 3.13.4, update to version 3.13.4 or later. For Firefox versions 4.x through 12.0, update to a version after 12.0 or apply the relevant patch. For Firefox ESR versions 10.x prior to 10.0.5, update to version 10.0.5 or later. For Thunderbird versions 5.0 through 12.0, update to a version after 12.0 or apply the relevant patch. For Thunderbird ESR versions 10.x prior to 10.0.5, update to version 10.0.5 or later. For SeaMonkey versions prior to 2.10, update to version 2.10 or later.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2012_1091

CVE-2012-0441

DSA-2490-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10218-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:14572-1

RHSA-2012:1090

RHSA-2012:1091

RHSA-2012_1090

RHSA-2012_1091

Affected Products

Centos

Firefox

Firefox Esr

Network Security Services

Red Hat

Seamonkey

Suse

Thunderbird

Thunderbird Esr

References · 3104

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://bdu.fstec.ru/vul/2015-00064 · Security Note