CVE-2012-5840
Description
Use-after-free in nsTextEditorState::PrepareEditor allows arbitrary code execution via crafted web content in Firefox before 17.0, ESR 10.x before 10.0.11, Thunderbird, and SeaMonkey.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Use-after-free in nsTextEditorState::PrepareEditor allows arbitrary code execution via crafted web content in Firefox before 17.0, ESR 10.x before 10.0.11, Thunderbird, and SeaMonkey.
Vulnerability
A use-after-free vulnerability exists in the nsTextEditorState::PrepareEditor function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. The flaw occurs during editor preparation and can be triggered by processing specially crafted web content, leading to heap memory corruption [1][4]. Address Sanitizer analysis confirmed a heap-use-after-free at nsCOMPtr::operator=, called from PrepareEditor [3].
Exploitation
An attacker can exploit this vulnerability by hosting a malicious web page that triggers the faulting code path in the browser. No special network position or elevated privileges are required; the attacker only needs to convince a user to visit the crafted page. The flaw does not require user interaction beyond normal browsing and is remotely exploitable over the web [1][4]. The bug is reachable in browser or browser-like contexts; in Thunderbird and SeaMonkey, scripting is disabled by default for email, reducing but not eliminating the risk [4].
Impact
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the affected application, or cause a denial of service via heap memory corruption [1][4]. The impact is critical, with CVSS base score reflecting remote code execution potential.
Mitigation
The vulnerability is fixed in Firefox 17, Firefox ESR 10.0.11, SeaMonkey 2.14, Thunderbird 17, and Thunderbird ESR 10.0.11 [2][4]. Red Hat released updated packages (RHSA-2012:1482 and RHSA-2012:1483) for Red Hat Enterprise Linux 5 and 6 [1][2]. Users should update to the patched versions; no workaround is provided.
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
32cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <10.0.11
- (no CPE)range: <10.0.11
- (no CPE)range: <17.0
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*range: <2.14
- (no CPE)range: <2.14
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <17.0
- cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*range: <10.0.11
- (no CPE)range: <10.0.11
- (no CPE)range: <17.0
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
- osv-coords2 versionspkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed
< 50.1.0-1.1+ 1 more
- (no CPE)range: < 50.1.0-1.1
- (no CPE)range: < 45.5.1-1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
27- bugzilla.mozilla.org/show_bug.cginvdExploitIssue TrackingPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2012-11/msg00090.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2012-11/msg00092.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2012-11/msg00093.htmlnvdMailing ListThird Party Advisory
- osvdb.org/87606nvdBroken LinkThird Party Advisory
- rhn.redhat.com/errata/RHSA-2012-1482.htmlnvdThird Party Advisory
- rhn.redhat.com/errata/RHSA-2012-1483.htmlnvdThird Party Advisory
- secunia.com/advisories/51359nvdThird Party Advisory
- secunia.com/advisories/51360nvdThird Party Advisory
- secunia.com/advisories/51369nvdThird Party Advisory
- secunia.com/advisories/51370nvdThird Party Advisory
- secunia.com/advisories/51381nvdThird Party Advisory
- secunia.com/advisories/51434nvdThird Party Advisory
- secunia.com/advisories/51439nvdThird Party Advisory
- secunia.com/advisories/51440nvdThird Party Advisory
- www.mandriva.com/security/advisoriesnvdThird Party Advisory
- www.mozilla.org/security/announce/2012/mfsa2012-105.htmlnvdVendor Advisory
- www.securityfocus.com/bid/56635nvdThird Party AdvisoryVDB Entry
- www.ubuntu.com/usn/USN-1636-1nvdThird Party Advisory
- www.ubuntu.com/usn/USN-1638-1nvdThird Party Advisory
- www.ubuntu.com/usn/USN-1638-2nvdThird Party Advisory
- www.ubuntu.com/usn/USN-1638-3nvdThird Party Advisory
- exchange.xforce.ibmcloud.com/vulnerabilities/80190nvdThird Party AdvisoryVDB Entry
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16904nvdThird Party Advisory
- www.palemoon.org/releasenotes-ng.shtmlnvdBroken Link
News mentions
0No linked articles in our index yet.