Fluid Attacks Database

Description

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	firefox	<0:10.0.6-1.el5_8	0:10.0.6-1.el5_8
rpm rhel5	xulrunner	<0:10.0.6-2.el5_8	0:10.0.6-2.el5_8
rpm rhel6	firefox	<0:10.0.6-1.el6_3	0:10.0.6-1.el6_3
rpm rhel6	xulrunner	<0:10.0.6-1.el6_3	0:10.0.6-1.el6_3

Aliases

1. CVE-2012-19652. NVD-2012-19653. OSV-2012-1965

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.