CVE-2012-4202
high · 9.3Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via a crafted GIF image.
9.3
CVSS
11.1%
EPSS (exploit prob.)
96th
EPSS percentile
2012-11-21
Published
AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-787
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox | < 10.0.11 |
| mozilla | firefox | < 17.0 |
| mozilla | seamonkey | < 2.14 |
| mozilla | thunderbird | < 17.0 |
| mozilla | thunderbird_esr | < 10.0.11 |
| opensuse | opensuse | 11.4 |
| opensuse | opensuse | 12.1 |
| opensuse | opensuse | 12.2 |
| suse | linux_enterprise_desktop | 10 |
| suse | linux_enterprise_desktop | 11 |
| suse | linux_enterprise_server | 10 |
| suse | linux_enterprise_server | 11 |
| suse | linux_enterprise_server | 11 |
| suse | linux_enterprise_software_development_kit | 10 |
| suse | linux_enterprise_software_development_kit | 11 |
| canonical | ubuntu_linux | 10.04 |
| canonical | ubuntu_linux | 11.10 |
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 12.10 |
| redhat | enterprise_linux_desktop | 5.0 |
| redhat | enterprise_linux_desktop | 6.0 |
| redhat | enterprise_linux_eus | 6.3 |
| redhat | enterprise_linux_server | 5.0 |
| redhat | enterprise_linux_server | 6.0 |
| redhat | enterprise_linux_workstation | 5.0 |
| redhat | enterprise_linux_workstation | 6.0 |
Check a specific version with /api/v1/cve/match.
References
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html
- http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html
- http://rhn.redhat.com/errata/RHSA-2012-1482.html
- http://rhn.redhat.com/errata/RHSA-2012-1483.html
- http://secunia.com/advisories/51359
- http://secunia.com/advisories/51360
- http://secunia.com/advisories/51369
- http://secunia.com/advisories/51370
- http://secunia.com/advisories/51381
- http://secunia.com/advisories/51434
- http://secunia.com/advisories/51439
- http://secunia.com/advisories/51440
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:173
- http://www.mozilla.org/security/announce/2012/mfsa2012-92.html
- http://www.securityfocus.com/bid/56614
- http://www.ubuntu.com/usn/USN-1636-1
- http://www.ubuntu.com/usn/USN-1638-1
- http://www.ubuntu.com/usn/USN-1638-2
- http://www.ubuntu.com/usn/USN-1638-3
- https://bugzilla.mozilla.org/show_bug.cgi?id=758200
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80170
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16739
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2012-4202