Fluid Attacks Database

Description

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	firefox	<0:10.0.6-1.el5_8	0:10.0.6-1.el5_8
rpm rhel6	firefox	<0:10.0.6-1.el6_3	0:10.0.6-1.el6_3
rpm rhel5	xulrunner	<0:10.0.6-2.el5_8	0:10.0.6-2.el5_8
rpm rhel6	xulrunner	<0:10.0.6-1.el6_3	0:10.0.6-1.el6_3

Aliases

1. CVE-2012-19662. NVD-2012-19663. OSV-2012-1966

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.