CVE-2012-1945

Mozilla Firefox 4.x-12.0 and ESR 10.x < 10.0.5 - Exposure of Sensitive Information via IFRAME Shortcut File Display

Title source: llm

Description

Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow local users to obtain sensitive information via an HTML document that loads a shortcut (aka .lnk) file for display within an IFRAME element, as demonstrated by a network share implemented by (1) Microsoft Windows or (2) Samba.

References (8)

Core 8

Core References

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2012/mfsa2012-37.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16743

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2012:088

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2012-0710.html

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=670514

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2012-0715.html

Scores

EPSS 0.0046

EPSS Percentile 36.9%

Details

CWE

CWE-200

Status published

Products (33)

mozilla/firefox 4.0 (13 CPE variants)

mozilla/firefox 4.0.1

mozilla/firefox 5.0

mozilla/firefox 5.0.1

mozilla/firefox 6.0

mozilla/firefox 6.0.1

mozilla/firefox 6.0.2

mozilla/firefox 7.0

mozilla/firefox 7.0.1

mozilla/firefox 8.0

... and 23 more

Published Jun 05, 2012

Tracked Since Feb 18, 2026