Vulnerability Details : CVE-2012-1976
Use-after-free vulnerability in the nsHTMLSelectElement::SubmitNamesValues function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Threat overview for CVE-2012-1976
Top countries where our scanners detected CVE-2012-1976
Top open port discovered on systems with this issue
8200
IPs affected by CVE-2012-1976 2,348
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2012-1976!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2012-1976
Probability of exploitation activity in the next 30 days: 4.98%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 93 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-1976
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2012-1976
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-1976
-
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
[security-announce] SUSE-SU-2012:1167-1: important: Security update forMailing List;Third Party Advisory
-
http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
Third Party Advisory
-
http://www.debian.org/security/2012/dsa-2553
Third Party Advisory
-
http://www.debian.org/security/2012/dsa-2556
Debian -- Security Information -- DSA-2556-1 icedoveThird Party Advisory
-
http://www.debian.org/security/2012/dsa-2554
Debian -- Security Information -- DSA-2554-1 iceapeThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1548-2
USN-1548-2: Firefox regression | Ubuntu security noticesThird Party Advisory
-
http://www.securityfocus.com/bid/55319
Mozilla Firefox/Thunderbird/SeaMonkey CVE-2012-1976 Use-After-Free Memory Corruption VulnerabilityThird Party Advisory;VDB Entry
-
http://rhn.redhat.com/errata/RHSA-2012-1211.html
RHSA-2012:1211 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16818
Repository / Oval RepositoryThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-1210.html
RHSA-2012:1210 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1548-1
USN-1548-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.mozilla.org/security/announce/2012/mfsa2012-58.html
Use-after-free issues found using Address Sanitizer — MozillaVendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html
[security-announce] openSUSE-SU-2012:1065-1: critical: MozillaFirefox: UMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html
[security-announce] SUSE-SU-2012:1157-1: important: Security update forMailing List;Third Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=776213
776213 - (CVE-2012-1976) Heap-use-after-free in nsHTMLSelectElement::SubmitNamesValuesIssue Tracking;Vendor Advisory
Products affected by CVE-2012-1976
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*