{"api_version":"1","generated_at":"2026-07-23T04:22:07+00:00","cve":"CVE-2012-4201","urls":{"html":"https://cve.report/CVE-2012-4201","api":"https://cve.report/api/cve/CVE-2012-4201.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-4201","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-4201"},"summary":{"title":"CVE-2012-4201","description":"The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on.","state":"PUBLISHED","assigner":"mitre","published_at":"2012-11-21 12:55:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html","name":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"openSUSE-SU-2012:1583-1: moderate: update for MozillaFirefox","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1483.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1483.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html","name":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"openSUSE-SU-2012:1586-1: moderate: update for xulrunner","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51359","name":"http://secunia.com/advisories/51359","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA51359 - Red Hat update for firefox - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2012/dsa-2584","name":"http://www.debian.org/security/2012/dsa-2584","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-2584-1 iceape","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html","name":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"openSUSE-SU-2012:1585-1: moderate: update for MozillaThunderbird","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=747607","name":"https://bugzilla.mozilla.org/show_bug.cgi?id=747607","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Patch","Vendor Advisory"],"title":"747607 – (CVE-2012-4201) Problem with evalInSandbox and location","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51440","name":"http://secunia.com/advisories/51440","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA51440 - SUSE update for seamonkey - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51360","name":"http://secunia.com/advisories/51360","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA51360 - Red Hat update for thunderbird - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-1638-3","name":"http://www.ubuntu.com/usn/USN-1638-3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-1638-3: Firefox regressions | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2012/dsa-2588","name":"http://www.debian.org/security/2012/dsa-2588","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-2588-1 icedove","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html","name":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[security-announce] openSUSE-SU-2013:0175-1: important: security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51439","name":"http://secunia.com/advisories/51439","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA51439 - SUSE update for MozillaFirefox - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:173","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:173","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Support / Security / Advisories /  / MDVSA-2012:173 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/87594","name":"http://osvdb.org/87594","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.debian.org/security/2012/dsa-2583","name":"http://www.debian.org/security/2012/dsa-2583","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-2583-1 iceweasel","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-1638-2","name":"http://www.ubuntu.com/usn/USN-1638-2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-1638-2: ubufox update | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html","name":"http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[security-announce] SUSE-SU-2012:1592-1: important: Security update for","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/56618","name":"http://www.securityfocus.com/bid/56618","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Mozilla Firefox, SeaMonkey, and Thunderbird CVE-2012-4201 Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ubuntu.com/usn/USN-1636-1","name":"http://www.ubuntu.com/usn/USN-1636-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-1636-1: Thunderbird vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51370","name":"http://secunia.com/advisories/51370","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA51370 - Ubuntu update for thunderbird - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51381","name":"http://secunia.com/advisories/51381","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80171","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80171","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51434","name":"http://secunia.com/advisories/51434","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA51434 - SUSE update for xulrunner - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1482.html","name":"http://rhn.redhat.com/errata/RHSA-2012-1482.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/51369","name":"http://secunia.com/advisories/51369","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA51369 - Ubuntu update for firefox - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-1638-1","name":"http://www.ubuntu.com/usn/USN-1638-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-1638-1: Firefox vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mozilla.org/security/announce/2012/mfsa2012-93.html","name":"http://www.mozilla.org/security/announce/2012/mfsa2012-93.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"MFSA 2012-93: evalInSanbox location context incorrectly applied","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15995","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15995","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4201","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4201","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"4201","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T20:28:07.572Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"USN-1638-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1638-3"},{"name":"51370","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51370"},{"name":"USN-1638-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1638-2"},{"name":"openSUSE-SU-2012:1586","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html"},{"name":"USN-1636-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1636-1"},{"name":"openSUSE-SU-2013:0175","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html"},{"name":"RHSA-2012:1483","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1483.html"},{"name":"DSA-2584","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2012/dsa-2584"},{"name":"RHSA-2012:1482","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1482.html"},{"name":"51434","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51434"},{"name":"openSUSE-SU-2012:1583","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html"},{"name":"51439","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51439"},{"name":"51440","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51440"},{"name":"USN-1638-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1638-1"},{"name":"oval:org.mitre.oval:def:15995","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15995"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.mozilla.org/security/announce/2012/mfsa2012-93.html"},{"name":"SUSE-SU-2012:1592","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html"},{"name":"51359","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51359"},{"name":"MDVSA-2012:173","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:173"},{"name":"56618","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/56618"},{"name":"openSUSE-SU-2012:1585","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html"},{"name":"87594","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/87594"},{"name":"51381","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51381"},{"name":"DSA-2583","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2012/dsa-2583"},{"name":"51369","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51369"},{"name":"firefox-evalinsandbox-sec-bypass(80171)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80171"},{"name":"51360","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51360"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=747607"},{"name":"DSA-2588","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2012/dsa-2588"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-11-20T00:00:00.000Z","descriptions":[{"lang":"en","value":"The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-18T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"USN-1638-3","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1638-3"},{"name":"51370","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51370"},{"name":"USN-1638-2","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1638-2"},{"name":"openSUSE-SU-2012:1586","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html"},{"name":"USN-1636-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1636-1"},{"name":"openSUSE-SU-2013:0175","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html"},{"name":"RHSA-2012:1483","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1483.html"},{"name":"DSA-2584","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2012/dsa-2584"},{"name":"RHSA-2012:1482","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2012-1482.html"},{"name":"51434","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51434"},{"name":"openSUSE-SU-2012:1583","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html"},{"name":"51439","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51439"},{"name":"51440","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51440"},{"name":"USN-1638-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1638-1"},{"name":"oval:org.mitre.oval:def:15995","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15995"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.mozilla.org/security/announce/2012/mfsa2012-93.html"},{"name":"SUSE-SU-2012:1592","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html"},{"name":"51359","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51359"},{"name":"MDVSA-2012:173","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:173"},{"name":"56618","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/56618"},{"name":"openSUSE-SU-2012:1585","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html"},{"name":"87594","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/87594"},{"name":"51381","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51381"},{"name":"DSA-2583","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2012/dsa-2583"},{"name":"51369","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51369"},{"name":"firefox-evalinsandbox-sec-bypass(80171)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80171"},{"name":"51360","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51360"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=747607"},{"name":"DSA-2588","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2012/dsa-2588"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2012-4201","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"USN-1638-3","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1638-3"},{"name":"51370","refsource":"SECUNIA","url":"http://secunia.com/advisories/51370"},{"name":"USN-1638-2","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1638-2"},{"name":"openSUSE-SU-2012:1586","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html"},{"name":"USN-1636-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1636-1"},{"name":"openSUSE-SU-2013:0175","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html"},{"name":"RHSA-2012:1483","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2012-1483.html"},{"name":"DSA-2584","refsource":"DEBIAN","url":"http://www.debian.org/security/2012/dsa-2584"},{"name":"RHSA-2012:1482","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2012-1482.html"},{"name":"51434","refsource":"SECUNIA","url":"http://secunia.com/advisories/51434"},{"name":"openSUSE-SU-2012:1583","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html"},{"name":"51439","refsource":"SECUNIA","url":"http://secunia.com/advisories/51439"},{"name":"51440","refsource":"SECUNIA","url":"http://secunia.com/advisories/51440"},{"name":"USN-1638-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1638-1"},{"name":"oval:org.mitre.oval:def:15995","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15995"},{"name":"http://www.mozilla.org/security/announce/2012/mfsa2012-93.html","refsource":"CONFIRM","url":"http://www.mozilla.org/security/announce/2012/mfsa2012-93.html"},{"name":"SUSE-SU-2012:1592","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html"},{"name":"51359","refsource":"SECUNIA","url":"http://secunia.com/advisories/51359"},{"name":"MDVSA-2012:173","refsource":"MANDRIVA","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:173"},{"name":"56618","refsource":"BID","url":"http://www.securityfocus.com/bid/56618"},{"name":"openSUSE-SU-2012:1585","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html"},{"name":"87594","refsource":"OSVDB","url":"http://osvdb.org/87594"},{"name":"51381","refsource":"SECUNIA","url":"http://secunia.com/advisories/51381"},{"name":"DSA-2583","refsource":"DEBIAN","url":"http://www.debian.org/security/2012/dsa-2583"},{"name":"51369","refsource":"SECUNIA","url":"http://secunia.com/advisories/51369"},{"name":"firefox-evalinsandbox-sec-bypass(80171)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80171"},{"name":"51360","refsource":"SECUNIA","url":"http://secunia.com/advisories/51360"},{"name":"https://bugzilla.mozilla.org/show_bug.cgi?id=747607","refsource":"CONFIRM","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=747607"},{"name":"DSA-2588","refsource":"DEBIAN","url":"http://www.debian.org/security/2012/dsa-2588"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2012-4201","datePublished":"2012-11-21T11:00:00.000Z","dateReserved":"2012-08-08T00:00:00.000Z","dateUpdated":"2024-08-06T20:28:07.572Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-11-21 12:55:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndExcluding":"17.0","matchCriteriaId":"23C27B04-A1E0-4930-AF63-E2B1E57F75BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0","versionEndExcluding":"10.0.11","matchCriteriaId":"46BBBC83-F777-4899-9F6A-094CDD9CFF0F"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*","versionEndExcluding":"2.14","matchCriteriaId":"D9DEF1D7-9412-4632-A689-AFD71FEFACC0"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionEndExcluding":"17.0","matchCriteriaId":"61E5E742-2A0F-4483-A784-EACBEE1DF267"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0","versionEndExcluding":"10.0.11","matchCriteriaId":"828E00D1-8F2A-43AF-93DB-B1985CE68A8A"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*","matchCriteriaId":"DE554781-1EB9-446E-911F-6C11970C47F4"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*","matchCriteriaId":"EBB2C482-D2A4-48B3-ACE7-E1DFDCC409B5"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*","matchCriteriaId":"D806A17E-B8F9-466D-807D-3F1E77603DC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*","matchCriteriaId":"F0545634-EC4A-48E8-AB3D-49802FB11758"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*","matchCriteriaId":"00720D8C-3FF3-4B1C-B74B-91F01A544399"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*","matchCriteriaId":"A53FF936-C785-4CEF-BAD0-3C3EB90EE466"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:*:*:*","matchCriteriaId":"F084E6C1-8DB0-4D1F-B8EB-5D2CD9AD6E87"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*","matchCriteriaId":"DB4D6749-81A1-41D7-BF4F-1C45A7F49A22"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*","matchCriteriaId":"436EF2ED-FDBB-4B64-8EC4-33C3E4253F06"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*","matchCriteriaId":"5AA37837-3083-4DC7-94F4-54FD5D7CB53C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*","matchCriteriaId":"133AAFA7-AF42-4D7B-8822-AA2E85611BF5"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*","matchCriteriaId":"EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*","matchCriteriaId":"8382A145-CDD9-437E-9DE7-A349956778B3"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*","matchCriteriaId":"54D669D4-6D7E-449D-80C1-28FA44F06FFE"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*","matchCriteriaId":"9BBCD86A-E6C7-4444-9D74-F861084090F0"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*","matchCriteriaId":"D0AC5CD5-6E58-433C-9EB3-6DFE5656463E"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*","matchCriteriaId":"E5ED5807-55B7-47C5-97A6-03233F4FBC3A"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*","matchCriteriaId":"01EDA41C-6B2E-49AF-B503-EB3882265C11"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*","matchCriteriaId":"E4174F4F-149E-41A6-BBCC-D01114C05F38"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*","matchCriteriaId":"8D305F7A-D159-4716-AB26-5E38BB5CD991"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*","matchCriteriaId":"E2076871-2E80-4605-A470-A41C1A8EC7EE"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*","matchCriteriaId":"036E8A89-7A16-411F-9D31-676313BB7244"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"16F59A04-14CF-49E2-9973-645477EA09DA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"4201","Ordinal":"1","Title":"CVE-2012-4201","CVE":"CVE-2012-4201","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"4201","Ordinal":"1","NoteData":"The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on.","Type":"Description","Title":"CVE-2012-4201"},{"CveYear":"2012","CveId":"4201","Ordinal":"2","NoteData":"2012-11-21","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"4201","Ordinal":"3","NoteData":"2017-09-18","Type":"Other","Title":"Modified"}]}}}