CVE-2012-3978 Security feature bypass in n/a
Remote attackers can bypass content-loading restrictions in Mozilla Firefox via chrome code vectors, requiring user interaction to visit a malicious site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2012-3978?
CVE-2012-3978 is a medium-severity vulnerability in Mozilla Firefox, published on 29 Aug 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The nsLocation::CheckURL function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 does not properly follow the security model of the location object, which allows remote attackers to bypass intended content-loading restrictions or possibly have unspecified other impact via vectors involving chrome code.
Weakness: CWE-264
Which versions are affected by CVE-2012-3978?
It affects 4 products.
Products include Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird, Mozilla Thunderbird Esr.
How do I fix CVE-2012-3978?
Upgrade to a fixed version.
Is CVE-2012-3978 being exploited?
There is no known exploitation of CVE-2012-3978 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-rj2q-vc79-g8v7.