FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-4209

This CVE name corresponds to:

Entered Topic
2012-11-20 mozilla -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2012-4209
Phase Assigned(20120808)

Description

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the location property, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a binary plugin.

References

Source Reference
CONFIRM http://www.mozilla.org/security/announce/2012/mfsa2012-103.html
CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=792405
MANDRIVA MDVSA-2012:173
REDHAT RHSA-2012:1482
REDHAT RHSA-2012:1483
SUSE openSUSE-SU-2012:1583
SUSE openSUSE-SU-2012:1585
SUSE openSUSE-SU-2012:1586
SUSE SUSE-SU-2012:1592
SUSE openSUSE-SU-2013:0175
UBUNTU USN-1638-1
UBUNTU USN-1638-3
UBUNTU USN-1638-2
UBUNTU USN-1636-1
BID 56629
OVAL oval:org.mitre.oval:def:16880
SECUNIA 51359
SECUNIA 51360
SECUNIA 51369
SECUNIA 51381
SECUNIA 51434
SECUNIA 51439
SECUNIA 51440
SECUNIA 51370
XF firefox-toplocation-xss(80181)