Fluid Attacks Database

Description

The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	firefox	<0:10.0.6-1.el5_8	0:10.0.6-1.el5_8
rpm rhel6	firefox	<0:10.0.6-1.el6_3	0:10.0.6-1.el6_3
rpm rhel5	xulrunner	<0:10.0.6-2.el5_8	0:10.0.6-2.el5_8
rpm rhel6	xulrunner	<0:10.0.6-1.el6_3	0:10.0.6-1.el6_3

Aliases

1. CVE-2012-19502. NVD-2012-19503. OSV-2012-1950

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.