CVE-2012-4201

Mozilla Firefox < 17.0 - XSS

Title source: rule

Description

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on.

References (29)

... and 9 more

Scores

EPSS 0.0196
EPSS Percentile 83.4%

Details

CWE
CWE-79
Status published
Products (28)
mozilla/firefox < 17.0
mozilla/seamonkey < 2.14
mozilla/thunderbird < 17.0
mozilla/thunderbird_esr < 10.0.11
opensuse/opensuse
opensuse/opensuse
opensuse/opensuse
suse/linux_enterprise_desktop
suse/linux_enterprise_desktop
suse/linux_enterprise_server
... and 18 more
Published Nov 21, 2012
Tracked Since Feb 18, 2026