CVE-2012-3976

Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.

• CWE-200

• http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1210.htmlThird Party Advisory
• http://www.mozilla.org/security/announce/2012/mfsa2012-69.htmlVendor Advisory
• http://www.securityfocus.com/bid/55313Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1548-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-1548-2Third Party Advisory
• http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdfThird Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=768568Issue Tracking, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16060Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00028.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1210.htmlThird Party Advisory
• http://www.mozilla.org/security/announce/2012/mfsa2012-69.htmlVendor Advisory
• http://www.securityfocus.com/bid/55313Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1548-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-1548-2Third Party Advisory
• http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdfThird Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=768568Issue Tracking, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16060Third Party Advisory

Published

Aug 29, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3970Use-after-free vulnerability in the nsTArray_base::Length fu…
• CVE-2012-3971Summer Institute of Linguistics (SIL) Graphite 2, as used in…
• CVE-2012-3972The format-number functionality in the XSLT implementation i…
• CVE-2012-3973The debugger in the developer-tools subsystem in Mozilla Fir…
• CVE-2012-3974Untrusted search path vulnerability in the installer in Mozi…
• CVE-2012-3975The DOMParser component in Mozilla Firefox before 15.0, Thun…
• CVE-2012-3977Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2012-3978The nsLocation::CheckURL function in Mozilla Firefox before …
• CVE-2012-3979Mozilla Firefox before 15.0 on Android does not properly imp…
• CVE-2012-3980The web console in Mozilla Firefox before 15.0, Firefox ESR …
• CVE-2012-3981Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3…
• CVE-2012-3982Multiple unspecified vulnerabilities in the browser engine i…