NVD

Id
43814  
Name
CVE-2012-1956  
Description
Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2012-08-29  
Modified Date
2013-11-02  
Seq
2012-1956  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
220095 43814 CVE-2012-1956 openSUSE-SU-2012:1065  View
220096 43814 CVE-2012-1956 SUSE-SU-2012:1157  View
220097 43814 CVE-2012-1956 SUSE-SU-2012:1167  View
220098 43814 CVE-2012-1956 oval:org.mitre.oval:def:16367  View
220099 43814 CVE-2012-1956 RHSA-2012:1351  View
220100 43814 CVE-2012-1956 http://www.mozilla.org/security/announce/2012/mfsa2012-59.html  View
220101 43814 CVE-2012-1956 55260  View
220102 43814 CVE-2012-1956 USN-1548-1  View
220103 43814 CVE-2012-1956 USN-1548-2  View
220104 43814 CVE-2012-1956 https://bugzilla.mozilla.org/show_bug.cgi?id=756719  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
28228 JVNDB-2012-003935 複数の Mozilla 製品におけるクロスサイトスクリプティングの脆弱性 複数の Mozilla 製品は、location オブジェクト (window.location) にシャドウを適用するための Object.defineProperty メソッドの使用を適切に制限しないため、クロスサイトスクリプティング攻撃を実行される脆弱性が存在します。 CVE-2012-1956 55194 CVE-2012-1956 43814 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003935.html 2012-08-28 2012-11-21 View