What’s Vulnerable › Vulnerabilities

CVE-2012-0464

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-03-14 · updated 2026-06-16
• Weakness: CWE-399

Description

Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to execute arbitrary code via vectors involving an empty argument to the array.join function in conjunction with the triggering of garbage collection.

Affected products

• Mozilla Firefox: through 3.6.27; from 4.0 through 10.0; 10.0, 10.0.1, 10.0.2
• Mozilla Seamonkey: 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+97)
• Mozilla Thunderbird: from 1.0 through 3.1.19; from 5.0 (excl.) through 10.0
• Mozilla Thunderbird ESR: 10.0, 10.0.1, 10.0.2

References

• http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html
• http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html
• http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html
• http://pwn2own.zerodayinitiative.com/status.html
• http://rhn.redhat.com/errata/RHSA-2012-0387.html
• http://rhn.redhat.com/errata/RHSA-2012-0388.html
• http://secunia.com/advisories/48359
• http://secunia.com/advisories/48402
• http://secunia.com/advisories/48414
• http://secunia.com/advisories/48495
• http://secunia.com/advisories/48496
• http://secunia.com/advisories/48513

Get alerted when CVE-2012-0464 or the next vulnerability affects your stack