PT-2012-5113

CVE-2012-3985

Published

2012-10-09

Updated

2024-12-12

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 16.0 Thunderbird versions prior to 16.0 SeaMonkey versions prior to 2.13

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging initial-origin access after document.domain has been set, due to improper implementation of the HTML5 Same Origin Policy.

Recommendations For Mozilla Firefox versions prior to 16.0, update to version 16.0 or later. For Thunderbird versions prior to 16.0, update to version 16.0 or later. For SeaMonkey versions prior to 2.13, update to version 2.13 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Collin Jackson

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2012-3985