Mozilla Firefox up to 13 buffer overflow [CVE-2012-1952]

VulDB: Mozilla Firefox up to 13 buffer overflow [CVE-2012-1952]

General

Mozilla

scipID: 5672
Affected: Mozilla Firefox up to 13
Published: 07/17/2012 (Abhishek Arya (Inferno))
Risk: critical
Entry: 92.9% complete
Created: 07/23/2012
Updated: 09/03/2012

Summary

A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 13. Affected by this issue is an unknown function. The manipulation with an unknown input leads to a buffer overflow vulnerability. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 07/17/2012 by Abhishek Arya (Inferno) with Google as MFSA 2012-44 as advisory (Website). The advisory is shared for download at mozilla.org. The public release has been coordinated in cooperation with the vendor. This vulnerability is handled as CVE-2012-1952 since 03/30/2012. The exploitability is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a private exploit is available.

Upgrading to version 14 eliminates this vulnerability. The upgrade is hosted for download at mozilla.org. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (83999) and Secunia (SA49965).