CVE-2012-0479

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-04-25 · updated 2026-06-16

Description

Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content.

Affected products

Mozilla Firefox: 4.0, 4.0-beta1, 4.0-beta10, 4.0-beta11, 4.0-beta12, 4.0-beta2 (+24)
Mozilla Seamonkey: through 2.9; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+106)
Mozilla Thunderbird: 5.0, 6.0, 6.0.1, 6.0.2, 7.0, 7.0.1 (+9)
Mozilla Thunderbird ESR: 10.0, 10.0.1, 10.0.2, 10.0.3

References

http://secunia.com/advisories/48920
http://secunia.com/advisories/48922
http://secunia.com/advisories/48972
http://secunia.com/advisories/49047
http://secunia.com/advisories/49055
http://www.debian.org/security/2012/dsa-2457
http://www.debian.org/security/2012/dsa-2458
http://www.debian.org/security/2012/dsa-2464
http://www.mandriva.com/security/advisories?name=MDVSA-2012:066
http://www.mandriva.com/security/advisories?name=MDVSA-2012:081
http://www.mozilla.org/security/announce/2012/mfsa2012-33.html
http://www.securityfocus.com/bid/53224

Get alerted when CVE-2012-0479 or the next vulnerability affects your stack