CVE-2012-3973

Firefox < 15.0 - Remote Code Execution via Developer Tools Debugger

Title source: llm

Description

The debugger in the developer-tools subsystem in Mozilla Firefox before 15.0, when remote debugging is disabled, does not properly restrict access to the remote-debugging service, which allows remote attackers to execute arbitrary code by leveraging the presence of the HTTPMonitor extension and connecting to that service through the HTTPMonitor port.

References (10)

Core 10

Core References

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17039

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=757128

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2012/mfsa2012-66.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/55308

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/85005

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1548-1

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1548-2

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html

Scores

EPSS 0.0493

EPSS Percentile 91.2%

Details

CWE

CWE-264

Status published

Products (47)

mozilla/firefox 1.0 (2 CPE variants)

mozilla/firefox 1.0.1

mozilla/firefox 1.0.2

mozilla/firefox 1.0.3

mozilla/firefox 1.0.4

mozilla/firefox 1.0.5

mozilla/firefox 1.0.6

mozilla/firefox 1.0.7

mozilla/firefox 1.0.8

mozilla/firefox 1.4.1

... and 37 more

Published Aug 29, 2012

Tracked Since Feb 18, 2026