PT-2012-4473 · Mozilla+3 · Firefox+7

Ken · Published 2012-06-05 · Updated 2024-10-21 · CVE-2012-3105

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 12.0 Firefox ESR versions 10.x before 10.0.5 Thunderbird versions 5.0 through 12.0 Thunderbird ESR versions 10.x before 10.0.5 SeaMonkey versions prior to 2.10

Description The issue is related to the glBufferData function in the WebGL implementation, which does not properly mitigate a flaw in an NVIDIA driver. This allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors.

Recommendations For Mozilla Firefox versions 4.x through 12.0, update to a version after 12.0. For Firefox ESR versions 10.x before 10.0.5, update to version 10.0.5 or later. For Thunderbird versions 5.0 through 12.0, update to a version after 12.0. For Thunderbird ESR versions 10.x before 10.0.5, update to version 10.0.5 or later. For SeaMonkey versions prior to 2.10, update to version 2.10 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2012_0710

CESA-2012_0715

CVE-2012-3105

RHSA-2012:0710

RHSA-2012:0715

RHSA-2012_0710

RHSA-2012_0715

Affected Products

Centos

Firefox Esr

Firefox

Nvidia Driver

Red Hat

Seamonkey

Thunderbird

Thunderbird Esr

References · 44

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1947 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1941 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1945 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1946 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3105 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2012-34 · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00004 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1938 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1937 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-3105 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3101 · Security Note
• http://mozilla.org/security/announce/2012/mfsa2012-34.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1939 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1944 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1940 · Security Note