CVE-2012-0449

Mozilla Firefox < 3.6.26 and 4.x-9.0 - Remote Code Execution via Malformed XSLT Stylesheet

Title source: llm
STIX 2.1

Description

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT stylesheet that is embedded in a document.

References (13)

Core 13
Core References
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=701806
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/72868
Issue Tracking, Patch, Vendor Advisory x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=702466
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2402
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2400
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00003.html
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2012:013
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2406
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00007.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/51754
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html

Scores

EPSS 0.0395
EPSS Percentile 88.5%

Details

CWE
CWE-119
Status published
Products (12)
debian/debian_linux 5.0
debian/debian_linux 6.0
mozilla/firefox < 3.6.26
mozilla/seamonkey < 2.7
mozilla/thunderbird < 3.1.18
opensuse/opensuse 11.4
suse/linux_enterprise_desktop 10 sp4
suse/linux_enterprise_desktop 11 sp1
suse/linux_enterprise_server 10 sp4
suse/linux_enterprise_server 11 sp1 (2 CPE variants)
... and 2 more
Published Feb 01, 2012
Tracked Since Feb 18, 2026