VYPR
Unrated severityNVD Advisory· Published Oct 12, 2012· Updated Apr 29, 2026

CVE-2012-4193

CVE-2012-4193

Description

Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same Origin Policy and read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site.

Affected products

21
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
    Range: <16.0.1
  • cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
    Range: <2.13.1
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
    Range: <16.0.1
  • cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*
    Range: >=10.0,<10.0.9
  • cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*
    • cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
  • cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*
    • cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
    • cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
  • cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*+ 3 more
    • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
    • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.