CVE-2012-4195

Mozilla Firefox < 10.0.10 - XSS

Title source: rule

Description

The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior.

References (18)

Scores

EPSS 0.0096
EPSS Percentile 76.3%

Details

CWE
CWE-79
Status published
Products (27)
mozilla/firefox < 10.0.10
mozilla/seamonkey < 2.13.2
mozilla/thunderbird < 16.0.2
mozilla/thunderbird_esr < 10.0.10
opensuse/opensuse
opensuse/opensuse
opensuse/opensuse
suse/linux_enterprise_desktop
suse/linux_enterprise_desktop
suse/linux_enterprise_server
... and 17 more
Published Oct 29, 2012
Tracked Since Feb 18, 2026