Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2012-3993: Firefox, Thunderbird, SeaMonkey let website run privileged code
CVE-2012-3993 · published 14 years ago
Summary
Versions of Firefox, Thunderbird and SeaMonkey released before their respective updates can be tricked by a malicious website into running JavaScript with high-level browser privileges. This could let an attacker perform actions that normally only the browser itself can do. Update the browsers to the latest versions or apply the vendor’s security patches as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox |
10.0 10.0.1 10.0.2 10.0.3 10.0.4 10.0.5 10.0.6 10.0.7 <= 15.0.1 1.0 1.0.1 1.0.2 128 more version ranges
cpe:2.3:a:mozilla:firefox:10.0:*:*:*:*:*:*:* |
| mozilla | thunderbird_esr |
10.0 10.0.1 10.0.2 10.0.3 10.0.4 10.0.5 10.0.6 10.0.7 cpe:2.3:a:mozilla:thunderbird_esr:10.0:*:*:*:*:*:*:* |
| mozilla | thunderbird |
<= 15.0.1 1.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6 1.0.7 1.0.8 1.5 1.5.0.1 93 more version ranges
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| mozilla | seamonkey |
<= 2.13 2.0 2.0.1 2.0.2 2.0.3 2.0.4 2.0.5 2.0.6 2.0.7 2.0.8 2.0.9 2.0.10 26 more version ranges
cpe:2.3:a:mozilla:seamonkey:*:beta6:*:*:*:*:*:* |
Original advisory text
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13...
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue.
References
- http://osvdb.org/86111 Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html Mailing List Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-1351.html Third Party Advisory
- http://secunia.com/advisories/50856 Third Party Advisory
- http://secunia.com/advisories/50892 Third Party Advisory
- http://secunia.com/advisories/50904 Third Party Advisory
- http://secunia.com/advisories/50935 Third Party Advisory
- http://secunia.com/advisories/50936 Third Party Advisory
- http://secunia.com/advisories/50984 Third Party Advisory
- http://secunia.com/advisories/55318 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:163 Third Party Advisory
- http://www.mozilla.org/security/announce/2012/mfsa2012-83.html Vendor Advisory
- http://www.securityfocus.com/bid/56119 Third Party Advisory VDB Entry
- http://www.ubuntu.com/usn/USN-1611-1 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=768101 Issue Tracking Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79153 Third Party Advisory VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3... Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-269Improper Privilege Management
Timeline
Published10 Oct 2012
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2012-3993 · NVD
Track software like this
Free during beta