PT-2012-3695 · Mozilla+3 · Firefox Esr+4

Jesse Ruderman + 2 · Published 2012-07-17 · Updated 2024-12-12 · CVE-2012-1965

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 13.0 Mozilla Firefox ESR versions 10.x before 10.0.6

Description The issue allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms. This is achieved via a feed:javascript: URL, which is not properly handled in terms of its security context.

Recommendations For Mozilla Firefox versions 4.x through 13.0, update to a version later than 13.0 to resolve the issue. For Mozilla Firefox ESR versions 10.x before 10.0.6, update to version 10.0.6 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CESA-2012_1088

CVE-2012-1965

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2012:1088

RHSA-2012_1088

Affected Products

Centos

Firefox

Firefox Esr

Red Hat

Suse

References · 2115

• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1088.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1951 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1954 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1948 · Security Note
• http://ubuntu.com/usn/USN-1509-2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1962 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1953 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1959 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1966 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2012-55 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1967 · Security Note