National Cyber Awareness System

Vulnerability Summary for CVE-2012-4210

Overview

The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted stylesheet.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=796866

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=796866

External Source: XF

Name: firefox-style-inspector-priv-esc(80182)

Hyperlink:http://xforce.iss.net/xforce/xfdb/80182

External Source: UBUNTU

Name: USN-1638-3

Hyperlink:http://www.ubuntu.com/usn/USN-1638-3

External Source: UBUNTU

Name: USN-1638-2

Hyperlink:http://www.ubuntu.com/usn/USN-1638-2

External Source: UBUNTU

Name: USN-1638-1

Hyperlink:http://www.ubuntu.com/usn/USN-1638-1

External Source: BID

Name: 56646

Hyperlink:http://www.securityfocus.com/bid/56646

External Source: CONFIRM

Name: http://www.palemoon.org/releasenotes-ng.shtml

Hyperlink:http://www.palemoon.org/releasenotes-ng.shtml

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2012/mfsa2012-104.html

Type: Advisory

Hyperlink:http://www.mozilla.org/security/announce/2012/mfsa2012-104.html

External Source: REDHAT

Name: RHSA-2012:1482

Hyperlink:http://rhn.redhat.com/errata/RHSA-2012-1482.html

External Source: SUSE

Name: openSUSE-SU-2012:1586

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html

External Source: SUSE

Name: openSUSE-SU-2012:1583

Hyperlink:http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html

External Source: SUSE

Name: openSUSE-SU-2013:0175

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html

External Source: SUSE

Name: SUSE-SU-2012:1592

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html