CVE-2012-3985

CVE	CVE-2012-3985
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2012-10-10 17:55:00 UTC
Updated	2020-08-26 19:36:00 UTC
Description	Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly implement the HTML5 Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging initial-origin access after document.domain has been set.

Problem Types: CWE-79

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	10.04	All	All	All
Operating System	Canonical	Ubuntu Linux	11.04	All	All	All
Operating System	Canonical	Ubuntu Linux	11.10	All	All	All
Operating System	Canonical	Ubuntu Linux	12.04	All	All	All
Operating System	Canonical	Ubuntu Linux	10.04	All	All	All
Operating System	Canonical	Ubuntu Linux	11.04	All	All	All
Operating System	Canonical	Ubuntu Linux	11.10	All	All	All
Operating System	Canonical	Ubuntu Linux	12.04	All	All	All
Application	Mozilla	Firefox	All	All	All	All
Application	Mozilla	Firefox	All	All	All	All
Application	Mozilla	Seamonkey	All	All	All	All
Application	Mozilla	Seamonkey	All	All	All	All
Application	Mozilla	Thunderbird	All	All	All	All
Application	Mozilla	Thunderbird	All	All	All	All
Operating System	Suse	Linux Enterprise Desktop	10	sp4	All	All
Operating System	Suse	Linux Enterprise Desktop	11	sp2	All	All
Operating System	Suse	Linux Enterprise Desktop	10	sp4	All	All
Operating System	Suse	Linux Enterprise Desktop	11	sp2	All	All
Operating System	Suse	Linux Enterprise Server	10	sp4	All	All
Operating System	Suse	Linux Enterprise Server	11	sp2	All	All
Operating System	Suse	Linux Enterprise Server	11	sp2	All	All
Operating System	Suse	Linux Enterprise Server	10	sp4	All	All
Operating System	Suse	Linux Enterprise Server	11	sp2	All	All
Operating System	Suse	Linux Enterprise Server	11	sp2	All	All

Reference	Source	Link	Tags
USN-1611-1: Thunderbird vulnerabilities \| Ubuntu	UBUNTU	www.ubuntu.com	Third Party Advisory
About Secunia Research \| Flexera	SECUNIA	secunia.com	Broken Link
About Secunia Research \| Flexera	SECUNIA	secunia.com	Broken Link
About Secunia Research \| Flexera	SECUNIA	secunia.com	Broken Link
86106	OSVDB	osvdb.org	Broken Link
Security Advisory SA50935 - Mozilla SeaMonkey Multiple Vulnerabilities - Secunia	SECUNIA	secunia.com	Broken Link
MFSA 2012-76: Continued access to initial origin after setting document.domain	CONFIRM	www.mozilla.org	Vendor Advisory
Repository / Oval Repository	OVAL	oval.cisecurity.org	Third Party Advisory
655649 – (CVE-2012-3985) Script access checks should use effective script origin, not origin	CONFIRM	bugzilla.mozilla.org	Issue Tracking, Vendor Advisory
Security Advisory SA50892 - Ubuntu update for firefox - Secunia	SECUNIA	secunia.com	Broken Link
[security-announce] SUSE-SU-2012:1351-1: important: Security update for	SUSE	lists.opensuse.org	Mailing List, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

690312 Free Berkeley Software Distribution (FreeBSD) Security Update for mozilla (6e5a9afd-12d3-11e2-b47d-c8600054b392)