CVE-2012-4187
Fixed in a distro release EPSS 7%
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly manage a certain insPos variable, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and assertion failure) via unspecified vectors.
Products: mozilla firefox, mozilla thunderbird_esr, mozilla thunderbird, mozilla seamonkey, canonical ubuntu_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_workstation, suse linux_enterprise_desktop, suse linux_enterprise_sdk, suse linux_enterprise_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 5 | firefox | 0:10.0.8-1.el5_8 |
| Red Hat Enterprise Linux 5 | firefox-debuginfo | 0:10.0.8-1.el5_8 |
| Red Hat Enterprise Linux 5 | thunderbird | 0:10.0.8-1.el5_8 |
| Red Hat Enterprise Linux 5 | thunderbird-debuginfo | 0:10.0.8-1.el5_8 |
| Red Hat Enterprise Linux 5 | xulrunner | 0:10.0.8-1.el5_8 |
| Red Hat Enterprise Linux 5 | xulrunner-debuginfo | 0:10.0.8-1.el5_8 |
| Red Hat Enterprise Linux 5 | xulrunner-devel | 0:10.0.8-1.el5_8 |
| Red Hat Enterprise Linux 6 | firefox | 0:10.0.8-1.el6_3 |
| Red Hat Enterprise Linux 6 | firefox-debuginfo | 0:10.0.8-1.el6_3 |
| Red Hat Enterprise Linux 6 | thunderbird | 0:10.0.8-1.el6_3 |
| Red Hat Enterprise Linux 6 | thunderbird-debuginfo | 0:10.0.8-1.el6_3 |
| Red Hat Enterprise Linux 6 | xulrunner | 0:10.0.8-1.el6_3 |
| Red Hat Enterprise Linux 6 | xulrunner-debuginfo | 0:10.0.8-1.el6_3 |
| Red Hat Enterprise Linux 6 | xulrunner-devel | 0:10.0.8-1.el6_3 |
| Red Hat rhel productivity 5 | thunderbird | 0:10.0.8-1.el5_8 |
| Red Hat rhel productivity 5 | thunderbird-debuginfo | 0:10.0.8-1.el5_8 |
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 |