CVE-2012-4207: canonical ubuntu_linux Cross-site Scripting

CVSS: 4.3v2.0MediumModified

Published 21-11-2012Last modified 06-08-2024

Vulnerability summary

CVE-2012-4207 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in canonical ubuntu_linux. EPSS estimates a 2.78% chance of exploitation in the next 30 days, higher than 86.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

2.78%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 8 · Related 3

DSA-2583-1 DSA-2584-1 DSA-2588-1 OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:10230-1 OPENSUSE-SU-2024:14572-1+2 more

Timeline

21-11-2012
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly handle a ~ (tilde) character in proximity to a chunk delimiter, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

2.78%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

0.00 pp

From 2.78% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.78%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.mozilla.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Mozilla4 products

firefox< 17.0 | ≥ 10.0, < 10.0.11
seamonkey< 2.14
thunderbird< 17.0
thunderbird_esr≥ 10.0, < 10.0.11

Redhat4 products

Suse3 products

linux_enterprise_desktop10:sp4 | 11:sp2
linux_enterprise_server10:sp4 | 11:sp2
linux_enterprise_software_development_kit10:sp4 | 11:sp2

Canonical1 product

ubuntu_linuxEOL10.04 | 11.10 | 12.04 | 12.10

Debian1 product

debian_linuxEOL6.0 | 7.0

Opensuse1 product

opensuseEOL11.4 | 12.1 | 12.2

6 vendors · 14 products

References

30 links

osvdb.org/87587VDB EntryX Refsource OSVDBBroken Link
www.ubuntu.com/usn/USN-1638-3Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/51370Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/USN-1638-2Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-updates/2012-11/msg00093.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.ubuntu.com/usn/USN-1636-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2012-1483.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.mozilla.org/security/announce/2012/mfsa2012-101.htmlX Refsource CONFIRMVendor Advisory
www.debian.org/security/2012/dsa-2584Vendor AdvisoryX Refsource DEBIANThird Party Advisory

Show all 30 references

www.palemoon.org/releasenotes-ng.shtmlX Refsource CONFIRMBroken Link
rhn.redhat.com/errata/RHSA-2012-1482.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/51434Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-updates/2012-11/msg00090.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/51439Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/51440Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/USN-1638-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.securityfocus.com/bid/56632VDB EntryX Refsource BIDThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/51359Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2012:173Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
lists.opensuse.org/opensuse-updates/2012-11/msg00092.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/51381Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2012/dsa-2583Vendor AdvisoryX Refsource DEBIANThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/80179VDB EntryX Refsource XFThird Party Advisory
secunia.com/advisories/51369Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/51360Third Party AdvisoryX Refsource SECUNIA
bugzilla.mozilla.org/show_bug.cgi?id=801681X Refsource CONFIRMExploitIssue TrackingPatchVendor Advisory
www.debian.org/security/2012/dsa-2588Vendor AdvisoryX Refsource DEBIANThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16955VDB EntrySignatureX Refsource OVALThird Party Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities