CVE-2012-3991: canonical ubuntu_linux

CVSS: 9.3v2.0HighModified

Published 10-10-2012Last modified 06-08-2024

Vulnerability summary

CVE-2012-3991 is a high (CVSS 9.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 3.08% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

3.08%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 3

DSA-2565-1 DSA-2569-1 DSA-2572-1 OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:10230-1 OPENSUSE-SU-2024:14572-1+2 more

Timeline

10-10-2012
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

3.08%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

0.00 pp

From 3.08% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.08%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Mozilla4 products

firefox< 10.0.8 | < 16.0
seamonkey< 2.13
thunderbird< 16.0
thunderbird_esr< 10.0.8

Redhat4 products

Suse3 products

Canonical1 product

ubuntu_linuxEOL10.04 | 11.04 | 11.10 | 12.04

4 vendors · 12 products

References

20 links

secunia.com/advisories/50904Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/50984Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/50935Third Party AdvisoryX Refsource SECUNIA
bugzilla.mozilla.org/show_bug.cgi?id=783260X Refsource CONFIRMIssue TrackingVendor Advisory
secunia.com/advisories/50856Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2012/dsa-2565Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/50892Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/55930VDB EntryX Refsource BIDThird Party Advisory
www.debian.org/security/2012/dsa-2572Vendor AdvisoryX Refsource DEBIANThird Party Advisory
rhn.redhat.com/errata/RHSA-2012-1351.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory

Show all 20 references

www.mozilla.org/security/announce/2012/mfsa2012-81.htmlX Refsource CONFIRMVendor Advisory
osvdb.org/86098VDB EntryX Refsource OSVDBBroken Link
secunia.com/advisories/50936Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/51181Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/55318Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2012:163Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16646VDB EntrySignatureX Refsource OVALThird Party Advisory
www.ubuntu.com/usn/USN-1611-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.debian.org/security/2012/dsa-2569Vendor AdvisoryX Refsource DEBIANThird Party Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities