CVE-2012-3993

Firefox 5.0 - 15.0.1 exposedProps XCS Code Execution

Title source: metasploit

Description

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubylocalmultiple

https://www.exploit-db.com/exploits/30474

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by Mariusz Mlynski, moz_bug_r_a4, joev · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb

View Code ZIP pw:eip

References (17)

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html

[Broken Link] http://osvdb.org/86111

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2012-1351.html

[Third Party Advisory] http://secunia.com/advisories/50856

[Third Party Advisory] http://secunia.com/advisories/50892

[Third Party Advisory] http://secunia.com/advisories/50904

[Third Party Advisory] http://secunia.com/advisories/50935

[Third Party Advisory] http://secunia.com/advisories/50936

[Third Party Advisory] http://secunia.com/advisories/50984

[Third Party Advisory] http://secunia.com/advisories/55318

[Third Party Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2012:163

[Vendor Advisory] http://www.mozilla.org/security/announce/2012/mfsa2012-83.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/56119

[Third Party Advisory] http://www.ubuntu.com/usn/USN-1611-1

[Issue Tracking, Vendor Advisory] https://bugzilla.mozilla.org/show_bug.cgi?id=768101

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/79153

[Third Party Advisory] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16718

Scores

EPSS 0.8084

EPSS Percentile 99.2%

Details

CWE

CWE-269

Status published

Products (47)

mozilla/firefox 10.0

mozilla/firefox 10.0.1

mozilla/firefox 10.0.2

mozilla/firefox 10.0.3

mozilla/firefox 10.0.4

mozilla/firefox 10.0.5

mozilla/firefox 10.0.6

mozilla/firefox 10.0.7

mozilla/firefox 1.0 (2 CPE variants)

mozilla/firefox 1.0.1

... and 37 more

Published Oct 10, 2012

Tracked Since Feb 18, 2026