CVE-2012-0444

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-02-01 · updated 2026-06-16
Weakness: CWE-119

Description

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file.

Affected products

Canonical Ubuntu Linux: 10.04, 10.10, 11.04, 11.10
Debian Linux: 5.0, 6.0
Mozilla Firefox: before 3.6.26; from 4.0 before 10.0 — fixed in 10.0, 3.6.26
Mozilla Seamonkey: before 2.7 — fixed in 2.7
Mozilla Thunderbird: before 3.1.18; from 5.0 before 10.0 — fixed in 10.0, 3.1.18
Opensuse: 11.4
SUSE Linux Enterprise Server 15 SP1: 10-sp4, 11-sp1
SUSE Linux Enterprise Server: 10-sp4, 11-sp1
SUSE Linux Enterprise Software Development Kit: 10-sp4, 11-sp1

How to fix

Upgrade to a fixed version: Mozilla Firefox 10.0, 3.6.26; Mozilla Seamonkey 2.7; Mozilla Thunderbird 10.0, 3.1.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2012-0444 or the next vulnerability affects your stack