PT-2012-3696 · Mozilla+3 · Firefox Esr+4

Moz_Bug_R_A4 · Published 2012-07-17 · Updated 2024-12-12 · CVE-2012-1966

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 13.0 Mozilla Firefox ESR versions 10.x before 10.0.6

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, due to insufficient context-menu restrictions for data: URLs compared to javascript: URLs.

Recommendations For Mozilla Firefox versions 4.x through 13.0, update to a version later than 13.0 to resolve the issue. For Mozilla Firefox ESR versions 10.x before 10.0.6, update to version 10.0.6 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2012_1088

CVE-2012-1966

DSA-2514-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2012:1088

RHSA-2012_1088

Affected Products

Centos

Firefox

Firefox Esr

Red Hat

Suse

References · 2117

• https://nvd.nist.gov/vuln/detail/CVE-2012-1966 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1088.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1951 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1954 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1948 · Security Note
• http://ubuntu.com/usn/USN-1509-2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1962 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1953 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1959 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1966 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1967 · Security Note