What’s Vulnerable › Vulnerabilities
CVE-2012-3966
- Severity: critical (CVSS 10.0 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2012-08-29 · updated 2026-06-16
- Weakness: CWE-119
Description
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a BMP image within a .ICO file, related to (1) improper handling of the transparency bitmask by the nsICODecoder component and (2) improper processing of the alpha channel by the nsBMPDecoder component.
Affected products
- Mozilla Firefox: through 14.0; 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5 (+144)
- Mozilla Seamonkey: through 2.11; 2.0, 2.0-alpha_1, 2.0-alpha_2, 2.0-alpha_3, 2.0-beta_1, 2.0-beta_2 (+72)
- Mozilla Thunderbird: through 14.0; 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+95)
- Mozilla Thunderbird ESR: 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5 (+1)
References
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
- http://rhn.redhat.com/errata/RHSA-2012-1210.html
- http://rhn.redhat.com/errata/RHSA-2012-1211.html
- http://www.mozilla.org/security/announce/2012/mfsa2012-61.html
- http://www.ubuntu.com/usn/USN-1548-1
- http://www.ubuntu.com/usn/USN-1548-2
- http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
- https://bugzilla.mozilla.org/show_bug.cgi?id=775793
- https://bugzilla.mozilla.org/show_bug.cgi?id=775794
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16246
Get alerted when CVE-2012-3966 or the next vulnerability affects your stack