Description
The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
References (18)
Core 18
Core References
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1509-2
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49977
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49992
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/54581
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2012-1088.html
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=633691
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49979
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49965
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00012.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49994
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00013.html
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1509-1
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2012/mfsa2012-54.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49993
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/84011
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/49972
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16783
Scores
EPSS
0.0090
EPSS Percentile
55.6%
Details
Status
published
Products (33)
mozilla/firefox
4.0 (13 CPE variants)
mozilla/firefox
4.0.1
mozilla/firefox
5.0
mozilla/firefox
5.0.1
mozilla/firefox
6.0
mozilla/firefox
6.0.1
mozilla/firefox
6.0.2
mozilla/firefox
7.0
mozilla/firefox
7.0.1
mozilla/firefox
8.0
... and 23 more
Published
Jul 18, 2012
Tracked Since
Feb 18, 2026