Vulnerability Details : CVE-2012-0452
Use-after-free vulnerability in Mozilla Firefox 10.x before 10.0.1, Thunderbird 10.x before 10.0.1, and SeaMonkey 2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger failure of an nsXBLDocumentInfo::ReadPrototypeBindings function call, related to the cycle collector's access to a hash table containing a stale XBL binding.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2012-0452
Probability of exploitation activity in the next 30 days: 12.97%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 95 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-0452
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2012-0452
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-0452
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:017
mandriva.com
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:018
mandriva.com
-
http://www.ubuntu.com/usn/USN-1360-1
USN-1360-1: Firefox vulnerability | Ubuntu security notices
-
http://www.mozilla.org/security/announce/2012/mfsa2012-10.html
use after free in nsXBLDocumentInfo::ReadPrototypeBindings — Mozilla
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15017
Repository / Oval Repository
-
http://secunia.com/advisories/48110
Sign in
-
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00013.html
[security-announce] SUSE-SU-2012:0261-1: critical: Security update for M
-
http://www.securityfocus.com/bid/51975
Mozilla Firefox/Thunderbird/SeaMonkey 'ReadPrototypeBindings()' Memory Corruption Vulnerability
-
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00012.html
[security-announce] openSUSE-SU-2012:0258-1: critical: MozillaFirefox to
-
https://bugzilla.mozilla.org/show_bug.cgi?id=724284
724284 - (CVE-2012-0452) use after free in nsXBLDocumentInfo::ReadPrototypeBindings
Products affected by CVE-2012-0452
- cpe:2.3:a:mozilla:firefox:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:2.7:*:*:*:*:*:*:*