You are here

CVE-2012-3980

Vincent (CVE) Danen's picture
The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval operation.

Details Source

Mitre

Public Date

2012-08-28 00:00:00

Impact

Important

Bugzilla

CVE-2012-3980 Mozilla: Web console eval capable of executing chrome-privileged code (MFSA 2012-72)

Bugzilla ID

851 939

CVSS Status

verified

Base Score

5.10

Base Metrics

AV:N/AC:H/Au:N/C:P/I:P/A:P

Acknowledgements

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges security Security researcher Colby Russell as the original reporter.

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 5 (firefox) RHSA-2012:1210 2012-08-29
Red Hat Enterprise Linux 5 (thunderbird) RHSA-2012:1211 2012-08-29
Red Hat Enterprise Linux 6 (thunderbird) RHSA-2012:1211 2012-08-29
Red Hat Enterprise Linux 6 (firefox) RHSA-2012:1210 2012-08-29
Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) (thunderbird) RHSA-2012:1211 2012-08-29

Affected Packages State

Platform Package State
Red Hat Enterprise Linux version 6 xulrunner 10.0.7-1.el6_3 Fixed
Red Hat Enterprise Linux version 5 xulrunner 10.0.7-2.el5_8 Fixed