Description
The nsWindow implementation in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 does not check the validity of an instance after event dispatching, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, as demonstrated by Mobile Firefox on Android.
References (15)
Core 15
Core References
Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/48402
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/48624
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/48629
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2012/mfsa2012-19.html
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=688208
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1026803
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/52466
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/48553
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/48561
Third Party Advisory vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15143
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1026801
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1026804
Scores
EPSS
0.0408
EPSS Percentile
89.5%
Details
CWE
CWE-20
Status
published
Products (39)
mozilla/firefox
10.0
mozilla/firefox
10.0.1
mozilla/firefox
10.0.2
mozilla/firefox
< 3.6.27
mozilla/seamonkey
mozilla/seamonkey
1.0 (3 CPE variants)
mozilla/seamonkey
1.0.1
mozilla/seamonkey
1.0.2
mozilla/seamonkey
1.0.3
mozilla/seamonkey
1.0.4
... and 29 more
Published
Mar 14, 2012
Tracked Since
Feb 18, 2026