Published: 14/03/2012 Updated: 18/01/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Mozilla Firefox prior to 3.6.28 and 4.x up to and including 10.0, Firefox ESR 10.x prior to 10.0.3, Thunderbird prior to 3.1.20 and 5.0 up to and including 10.0, Thunderbird ESR 10.x prior to 10.0.3, and SeaMonkey prior to 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote malicious users to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
mozilla firefox 4.0
mozilla firefox 5.0.1
mozilla firefox 5.0
mozilla firefox 8.0.1
mozilla firefox 9.0.1
mozilla firefox 4.0.1
mozilla firefox 7.0
mozilla firefox 8.0
mozilla firefox 6.0.2
mozilla firefox 6.0.1
mozilla firefox 9.0
mozilla firefox 6.0
mozilla firefox 7.0.1
mozilla firefox esr 10.2
mozilla firefox esr 10.1
mozilla firefox esr 10.0
mozilla thunderbird
mozilla thunderbird 5.0
mozilla thunderbird 6.0
mozilla thunderbird 6.0.1
mozilla thunderbird 6.0.2
mozilla thunderbird 8.0
mozilla thunderbird 9.0.1
mozilla thunderbird 9.0
mozilla thunderbird esr 10.0.1
mozilla thunderbird esr 10.0.2
mozilla thunderbird esr 10.0
mozilla seamonkey

Synopsis Critical: thunderbird security update Type/Severity Security Advisory: Critical Topic An updated thunderbird package that fixes multiple security issues is nowavailable for Red Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having criticalsecurity impact C ...

Synopsis Critical: firefox security and bug fix update Type/Severity Security Advisory: Critical Topic Updated firefox packages that fix multiple security issues and three bugsare now available for Red Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having criticalse ...

Several vulnerabilities have been discovered in Icedove, an unbranded version of the Thunderbird mail/news client CVE-2012-0455 Soroush Dalili discovered that a cross-site scripting countermeasure related to Javascript URLs could be bypassed CVE-2012-0456 Atte Kettunen discovered an out of bounds read in the SVG Filters, resulting in ...

Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of Seamonkey: CVE-2012-0455 Soroush Dalili discovered that a cross-site scripting countermeasure related to JavaScript URLs could be bypassed CVE-2012-0456 Atte Kettunen discovered an out of bounds read in the SVG Filters, resulting in memory di ...

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox The included XULRunner library provides rendering services for several other applications included in Debian CVE-2012-0455 Soroush Dalili discovered that a cross-site scripting countermeasure related to JavaScript URLs could be bypassed CVE-2012-0456 ...

Several security issues were fixed in Firefox ...

USN-1400-3 introduced regressions in Thunderbird ...

Firefox’s ability to use system proxy settings regressed ...

This update provides compatible ubufox packages for the latest Firefox ...

Several security issues were fixed in Thunderbird ...

Several security issues were fixed in Firefox ...

Mozilla Foundation Security Advisory 2012-13 XSS with Drag and Drop and Javascript: URL Announced March 13, 2012 Reporter Soroush Dalili Impact Moderate Products Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR ...

Get Started

CVE-2012-0455

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect