Vulnerability Details : CVE-2012-3972
The format-number functionality in the XSLT implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based buffer over-read.
Vulnerability category: Information leak
Threat overview for CVE-2012-3972
Top countries where our scanners detected CVE-2012-3972
Top open port discovered on systems with this issue
8200
IPs affected by CVE-2012-3972 2,348
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2012-3972!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2012-3972
Probability of exploitation activity in the next 30 days: 0.24%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 61 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-3972
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2012-3972
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-3972
-
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
[security-announce] SUSE-SU-2012:1167-1: important: Security update forMailing List;Third Party Advisory
-
http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
Third Party Advisory
-
http://www.debian.org/security/2012/dsa-2553
Third Party Advisory
-
http://www.debian.org/security/2012/dsa-2556
Debian -- Security Information -- DSA-2556-1 icedoveThird Party Advisory
-
http://www.debian.org/security/2012/dsa-2554
Debian -- Security Information -- DSA-2554-1 iceapeThird Party Advisory
-
http://www.mozilla.org/security/announce/2012/mfsa2012-65.html
Out-of-bounds read in format-number in XSLT — MozillaVendor Advisory
-
http://www.ubuntu.com/usn/USN-1548-2
USN-1548-2: Firefox regression | Ubuntu security noticesThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-1211.html
RHSA-2012:1211 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2012-1210.html
RHSA-2012:1210 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1548-1
USN-1548-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=746855
746855 - (CVE-2012-3972) [ASan] READ heap-buffer-overflow in format-number()Issue Tracking;Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html
[security-announce] openSUSE-SU-2012:1065-1: critical: MozillaFirefox: UMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html
[security-announce] SUSE-SU-2012:1157-1: important: Security update forMailing List;Third Party Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16234
Repository / Oval RepositoryThird Party Advisory
Products affected by CVE-2012-3972
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*