CVE-2012-1940

Firefox 4.x-12.0 and ESR 10.x < 10.0.5 - Use-After-Free in nsFrameList

Title source: llm
STIX 2.1

Description

Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by changing the size of a container of absolutely positioned elements in a column.

References (12)

Core 12
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0710.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-0715.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2012:088
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2488
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2499
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2489
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=747688
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17054
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/53794

Scores

EPSS 0.0453
EPSS Percentile 90.5%

Details

CWE
CWE-399
Status published
Products (33)
mozilla/firefox 4.0 (13 CPE variants)
mozilla/firefox 4.0.1
mozilla/firefox 5.0
mozilla/firefox 5.0.1
mozilla/firefox 6.0
mozilla/firefox 6.0.1
mozilla/firefox 6.0.2
mozilla/firefox 7.0
mozilla/firefox 7.0.1
mozilla/firefox 8.0
... and 23 more
Published Jun 05, 2012
Tracked Since Feb 18, 2026