CVE-2012-0458

Published: Mar 14, 2012Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict setting the home page through the dragging of a URL to the home button, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a javascript: URL that is later interpreted in the about:sessionrestore context.

Affected (114)

Products: Mozilla: Firefox, Thunderbird, Thunderbird Esr, Seamonkey

4 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.6.27

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	After 4.0 to 10.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 10.0.1
Mozilla Firefox	Version 10.0.2
Mozilla Firefox	Version 10.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Thunderbird	From 1.0 to 3.1.19

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Thunderbird	After 5.0 to 10.0

Configuration F

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Thunderbird Esr	Version 10.0.1
Mozilla Thunderbird Esr	Version 10.0.2
Mozilla Thunderbird Esr	Version 10.0

Configuration G

104 vulnerable

Vulnerable Software	Affected Versions
Mozilla Seamonkey	All versions
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.14
Mozilla Seamonkey	Version 1.1.15
Mozilla Seamonkey	Version 1.1.16
Mozilla Seamonkey	Version 1.1.17
Mozilla Seamonkey	Version 1.1.18
Mozilla Seamonkey	Version 1.1.19
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta
Mozilla Seamonkey	Version 1.5.0.10
Mozilla Seamonkey	Version 1.5.0.8
Mozilla Seamonkey	Version 1.5.0.9
Mozilla Seamonkey	Version 2.0.10
Mozilla Seamonkey	Version 2.0.11
Mozilla Seamonkey	Version 2.0.12
Mozilla Seamonkey	Version 2.0.13
Mozilla Seamonkey	Version 2.0.14
Mozilla Seamonkey	Version 2.0.1
Mozilla Seamonkey	Version 2.0.2
Mozilla Seamonkey	Version 2.0.3
Mozilla Seamonkey	Version 2.0.4
Mozilla Seamonkey	Version 2.0.5
Mozilla Seamonkey	Version 2.0.6
Mozilla Seamonkey	Version 2.0.7
Mozilla Seamonkey	Version 2.0.8
Mozilla Seamonkey	Version 2.0.9
Mozilla Seamonkey	Version 2.0
Mozilla Seamonkey	Version 2.0 alpha_1
Mozilla Seamonkey	Version 2.0 alpha_2
Mozilla Seamonkey	Version 2.0 alpha_3
Mozilla Seamonkey	Version 2.0 beta_1
Mozilla Seamonkey	Version 2.0 beta_2
Mozilla Seamonkey	Version 2.0 rc1
Mozilla Seamonkey	Version 2.0 rc2
Mozilla Seamonkey	Version 2.1
Mozilla Seamonkey	Version 2.1 alpha1
Mozilla Seamonkey	Version 2.1 alpha2
Mozilla Seamonkey	Version 2.1 alpha3
Mozilla Seamonkey	Version 2.1 beta1
Mozilla Seamonkey	Version 2.1 beta2
Mozilla Seamonkey	Version 2.1 beta3
Mozilla Seamonkey	Version 2.1 rc1
Mozilla Seamonkey	Version 2.1 rc2
Mozilla Seamonkey	Version 2.2
Mozilla Seamonkey	Version 2.2 beta1
Mozilla Seamonkey	Version 2.2 beta2
Mozilla Seamonkey	Version 2.2 beta3
Mozilla Seamonkey	Version 2.3.1
Mozilla Seamonkey	Version 2.3.2
Mozilla Seamonkey	Version 2.3.3
Mozilla Seamonkey	Version 2.3
Mozilla Seamonkey	Version 2.3 beta1
Mozilla Seamonkey	Version 2.3 beta2
Mozilla Seamonkey	Version 2.3 beta3
Mozilla Seamonkey	Version 2.4.1
Mozilla Seamonkey	Version 2.4
Mozilla Seamonkey	Version 2.4 beta1
Mozilla Seamonkey	Version 2.4 beta2
Mozilla Seamonkey	Version 2.4 beta3
Mozilla Seamonkey	Version 2.5
Mozilla Seamonkey	Version 2.5 beta1
Mozilla Seamonkey	Version 2.5 beta2
Mozilla Seamonkey	Version 2.5 beta3
Mozilla Seamonkey	Version 2.5 beta4
Mozilla Seamonkey	Version 2.6.1
Mozilla Seamonkey	Version 2.6
Mozilla Seamonkey	Version 2.6 beta1
Mozilla Seamonkey	Version 2.6 beta2
Mozilla Seamonkey	Version 2.6 beta3
Mozilla Seamonkey	Version 2.6 beta4
Mozilla Seamonkey	Version 2.7.1
Mozilla Seamonkey	Version 2.7.2
Mozilla Seamonkey	Version 2.7
Mozilla Seamonkey	Version 2.7 beta1
Mozilla Seamonkey	Version 2.7 beta2
Mozilla Seamonkey	Version 2.7 beta3
Mozilla Seamonkey	Version 2.7 beta4
Mozilla Seamonkey	Version 2.7 beta5

Related CWEs

CWE-264

References (72)

http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2012-0387.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0388.html

Source: cve@mitre.org

http://secunia.com/advisories/48359

Source: cve@mitre.org

http://secunia.com/advisories/48402

Source: cve@mitre.org

http://secunia.com/advisories/48414

Source: cve@mitre.org

http://secunia.com/advisories/48495

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48496

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48513

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48553

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48561

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48624

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48629

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48823

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48920

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2012/dsa-2433

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2012/dsa-2458

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2012:031

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2012:032

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2012/mfsa2012-16.html

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/52460

Source: cve@mitre.org

http://www.securitytracker.com/id?1026801

Source: cve@mitre.org

http://www.securitytracker.com/id?1026803

Source: cve@mitre.org

http://www.securitytracker.com/id?1026804

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1400-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1400-2

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-1400-3

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-1400-4

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-1400-5

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/USN-1401-1

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=718203

Source: cve@mitre.org

ExploitIssue TrackingVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=719994

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=723808

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15122

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html