CVE-2012-5835
critical
CVSS v3
—
CVSS v2
10.0
VIR risk
10.0
Description
Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (invalid write operation) via crafted data.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://bugzilla.mozilla.org/show_bug.cgi?id=790879
Vendor advisory: cve@mitre.org — http://www.mozilla.org/security/announce/2012/mfsa2012-106.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| ubuntu | 10.04 | affected | |
| ubuntu | 11.10 | affected | |
| ubuntu | 12.04 | affected | |
| ubuntu | 12.10 | affected | |
| suse | 11.4 | affected | |
| suse | 12.1 | affected | |
| suse | 12.2 | affected | |
| suse | 10 | affected | |
| suse | 11 | affected | |
| rhel | 5.0 | affected | |
| rhel | 6.0 | affected | |
| rhel | 6.3 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| mozilla | firefox | {"endExcluding":"10.0.11"} | 10.0.11 |
| mozilla | seamonkey | {"endExcluding":"2.14"} | 2.14 |
| mozilla | thunderbird | {"endExcluding":"17.0"} | 17.0 |
| mozilla | thunderbird_esr | {"endExcluding":"10.0.11"} | 10.0.11 |
References
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html
- http://osvdb.org/87601
- http://rhn.redhat.com/errata/RHSA-2012-1482.html
- http://rhn.redhat.com/errata/RHSA-2012-1483.html
- http://secunia.com/advisories/51359
- http://secunia.com/advisories/51360
- http://secunia.com/advisories/51369
- http://secunia.com/advisories/51370
- http://secunia.com/advisories/51381
- http://secunia.com/advisories/51434
- http://secunia.com/advisories/51439
- http://secunia.com/advisories/51440
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:173
- http://www.mozilla.org/security/announce/2012/mfsa2012-106.html
- http://www.securityfocus.com/bid/56643
- http://www.ubuntu.com/usn/USN-1636-1
- http://www.ubuntu.com/usn/USN-1638-1
- http://www.ubuntu.com/usn/USN-1638-2
- http://www.ubuntu.com/usn/USN-1638-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=790879
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80185
CWEs
CWE-190
Verify integrity in audit chain (admin only). AS-IS.