CVE-2012-1963

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 13.0 Mozilla Firefox ESR versions 10.x before 10.0.6 Thunderbird versions 5.0 through 13.0 Thunderbird ESR versions 10.x before 10.0.6 SeaMonkey versions prior to 2.11

Description The Content Security Policy functionality does not properly restrict the strings placed into the blocked-uri parameter of a violation report. This allows remote web servers to capture sensitive information, such as OpenID credentials and OAuth 2.0 access tokens, by triggering a violation.

Recommendations For Mozilla Firefox versions 4.x through 13.0, update to a version after 13.0. For Mozilla Firefox ESR versions 10.x before 10.0.6, update to version 10.0.6 or later. For Thunderbird versions 5.0 through 13.0, update to a version after 13.0. For Thunderbird ESR versions 10.x before 10.0.6, update to version 10.0.6 or later. For SeaMonkey versions prior to 2.11, update to version 2.11 or later.