CVE-2012-3965

Published: 29 August 2012

Mozilla Firefox before 15.0 does not properly restrict navigation to the about:newtab page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers creation of a new tab and then a new window.

Priority

Medium

Status

Package Release Status
firefox
Launchpad, Ubuntu, Debian
Upstream
Released (15.0)
seamonkey
Launchpad, Ubuntu, Debian
Upstream Needs triage

thunderbird
Launchpad, Ubuntu, Debian
Upstream Not vulnerable

xulrunner-1.9.2
Launchpad, Ubuntu, Debian
Upstream Needs triage

xulrunner-2.0
Launchpad, Ubuntu, Debian
Upstream Needs triage