CVE-2012-0478

Firefox 4.x-11.0 and Firefox ESR < 10.0.4 - Remote Code Execution via WebGL texImage2D

Title source: llm
STIX 2.1

Description

The texImage2D implementation in the WebGL subsystem in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 does not properly restrict JSVAL_TO_OBJECT casts, which might allow remote attackers to execute arbitrary code via a crafted web page.

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75155
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2012:081
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/49055
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/53227
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16893
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48972
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2012:066
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/49047
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=727547

Scores

EPSS 0.0351
EPSS Percentile 87.9%

Details

CWE
CWE-264
Status published
Products (34)
mozilla/firefox 4.0 (13 CPE variants)
mozilla/firefox 4.0.1
mozilla/firefox 5.0
mozilla/firefox 5.0.1
mozilla/firefox 6.0
mozilla/firefox 6.0.1
mozilla/firefox 6.0.2
mozilla/firefox 7.0
mozilla/firefox 7.0.1
mozilla/firefox 8.0
... and 24 more
Published Apr 25, 2012
Tracked Since Feb 18, 2026