Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2012-4208: Firefox, Thunderbird, SeaMonkey let web pages see hidden data

CVE-2012-4208 · published 13 years ago

Summary

Versions of Firefox before 17, Thunderbird before 17, and SeaMonkey before 2.14 do not properly block websites from accessing internal browser information. This can let a malicious site read data that should be reserved for the browser itself. Update to the latest versions of these browsers to close the gap.

What to do

Update mozilla firefox to version 17.0 or later.
Update mozilla seamonkey to version 2.14 or later.
Update mozilla thunderbird to version 17.0 or later.

Affected software

Vendor	Product	Affected versions
mozilla	firefox	< 17.0 `cpe:2.3:a:mozilla:firefox::::::::`
mozilla	seamonkey	< 2.14 `cpe:2.3:a:mozilla:seamonkey::::::::`
mozilla	thunderbird	< 17.0 `cpe:2.3:a:mozilla:thunderbird::::::::`
opensuse	opensuse	11.4 12.1 12.2 `cpe:2.3:o:opensuse:opensuse:11.4:::::::*`
suse	linux_enterprise_desktop	10 11 `cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4::::::`
suse	linux_enterprise_server	10 11 `cpe:2.3:o:suse:linux_enterprise_server:10:sp4::::::`
suse	linux_enterprise_software_development_kit	10 11 `cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4::::::`
canonical	ubuntu_linux	10.04 11.10 12.04 12.10 `cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::`

Original advisory text

The XrayWrapper implementation in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 does not consider the compartment during property filtering, which allows remote attackers to bypass intended chrome-only restrictions on reading DOM object properties via a crafted web site.

References

http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html Mailing List Third Party Advisory
http://secunia.com/advisories/51369 Third Party Advisory
http://secunia.com/advisories/51370 Third Party Advisory
http://secunia.com/advisories/51381 Third Party Advisory
http://secunia.com/advisories/51434 Third Party Advisory
http://secunia.com/advisories/51439 Third Party Advisory
http://secunia.com/advisories/51440 Third Party Advisory
http://www.mozilla.org/security/announce/2012/mfsa2012-99.html Vendor Advisory
http://www.securityfocus.com/bid/56627 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-1636-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-1638-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-1638-2 Third Party Advisory
http://www.ubuntu.com/usn/USN-1638-3 Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=798264 Issue Tracking Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published21 Nov 2012

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2012-4208 · NVD

Track software like this

Free during beta