CVE-2012-0444 Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote a...
HighCVSS 10.0
EPSS 7.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libvorbis(Debian:12) | < 1.3.2-1.2 | 1.3.2-1.2 |
| debian/libvorbis(Debian:13) | < 1.3.2-1.2 | 1.3.2-1.2 |
| debian/libvorbis(Debian:14) | < 1.3.2-1.2 | 1.3.2-1.2 |
| debian/libvorbisidec(Debian:12) | < 1.0.2+svn18153-0.1 | 1.0.2+svn18153-0.1 |
| debian/libvorbisidec(Debian:13) | < 1.0.2+svn18153-0.1 | 1.0.2+svn18153-0.1 |
| debian/libvorbisidec(Debian:14) | < 1.0.2+svn18153-0.1 | 1.0.2+svn18153-0.1 |
| mozilla Firefox | < 3.6.26 | 3.6.26 |
| mozilla Firefox | >= 4.0, < 10.0 | 10.0 |
| mozilla seamonkey | < 2.7 | 2.7 |
| mozilla Thunderbird | < 3.1.18 | 3.1.18 |
| mozilla Thunderbird | >= 5.0, < 10.0 | 10.0 |
| debian linux | = 5.0 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| SUSE linux enterprise desktop | = 10-sp4 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp1 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| SUSE linux enterprise software development kit | = 10-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp1 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| Canonical Ubuntu Linux | = 11.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.10 | No fix listed |
References
- Debian Security Tracker CVE-2012-0444 vendor-advisory
- SUSE-SU-2012:0198 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2012:0221 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2012:0234 mailing-list third-party-advisory vendor-advisory
- 48043 third-party-advisory
- 48095 third-party-advisory
- DSA-2400 third-party-advisory vendor-advisory
- DSA-2402 third-party-advisory vendor-advisory
- DSA-2406 third-party-advisory vendor-advisory
- MDVSA-2012:013 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- 51753 third-party-advisory vdb-entry
- USN-1370-1 third-party-advisory vendor-advisory
- bugzilla.mozilla.org exploit issue-tracking patch vendor-advisory
- mozilla-nschildview-code-exec(72858) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:14464 signature third-party-advisory vdb-entry
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking