PT-2012-5949 · Mozilla · Firefox+2

David Bloom + 1 · Published 2012-10-10 · Updated 2020-08-26 · CVE-2012-5354

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 16.0 Thunderbird versions prior to 16.0 SeaMonkey versions prior to 2.13

Description The issue arises from improper handling of navigation away from a web page with multiple active menus of SELECT elements, allowing remote attackers to conduct clickjacking attacks. This can be achieved through vectors involving an XPI file, the window.open method, and the Geolocation API.

Recommendations For Mozilla Firefox versions prior to 16.0, update to version 16.0 or later. For Thunderbird versions prior to 16.0, update to version 16.0 or later. For SeaMonkey versions prior to 2.13, update to version 2.13 or later.

Fix

Related Identifiers

CVE-2012-5354

Affected Products

Firefox

Seamonkey

Thunderbird

References · 7

• http://mozilla.org/security/announce/2012/mfsa2012-75.html · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=726264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5354 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16972 · Note
• http://secunia.com/advisories/50856 · Note
• http://osvdb.org/86171 · Note
• http://secunia.com/advisories/50935 · Note