CVE-2012-4194

Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.

• CWE-79

• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1407.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1413.htmlThird Party Advisory
• http://secunia.com/advisories/51121Third Party Advisory
• http://secunia.com/advisories/51123Third Party Advisory
• http://secunia.com/advisories/51127Third Party Advisory
• http://secunia.com/advisories/51144Third Party Advisory
• http://secunia.com/advisories/51146Third Party Advisory
• http://secunia.com/advisories/51147Third Party Advisory
• http://secunia.com/advisories/51165Third Party Advisory
• http://secunia.com/advisories/55318Third Party Advisory
• http://www.mozilla.org/security/announce/2012/mfsa2012-90.htmlVendor Advisory
• http://www.securityfocus.com/bid/56301Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1620-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-1620-2Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=800666Exploit, Issue Tracking, Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16918Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00019.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00025.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1407.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1413.htmlThird Party Advisory
• http://secunia.com/advisories/51121Third Party Advisory
• http://secunia.com/advisories/51123Third Party Advisory
• http://secunia.com/advisories/51127Third Party Advisory
• http://secunia.com/advisories/51144Third Party Advisory
• http://secunia.com/advisories/51146Third Party Advisory
• http://secunia.com/advisories/51147Third Party Advisory
• http://secunia.com/advisories/51165Third Party Advisory
• http://secunia.com/advisories/55318Third Party Advisory
• http://www.mozilla.org/security/announce/2012/mfsa2012-90.htmlVendor Advisory
• http://www.securityfocus.com/bid/56301Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1620-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-1620-2Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=800666Exploit, Issue Tracking, Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16918Third Party Advisory

Published

Oct 29, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4188Heap-based buffer overflow in the Convolve3x3 function in Mo…
• CVE-2012-4189Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x a…
• CVE-2012-4190The FT2FontEntry::CreateFontEntry function in FreeType, as u…
• CVE-2012-4191The mozilla::net::FailDelayManager::Lookup function in the W…
• CVE-2012-4192Mozilla Firefox 16.0, Thunderbird 16.0, and SeaMonkey 2.13 a…
• CVE-2012-4193Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.…
• CVE-2012-4195The nsLocation::CheckURL function in Mozilla Firefox before …
• CVE-2012-4196Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.…
• CVE-2012-4197Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and…
• CVE-2012-4198The User.get method in Bugzilla/WebService/User.pm in Bugzil…
• CVE-2012-4199template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x…
• CVE-2012-4201The evalInSandbox implementation in Mozilla Firefox before 1…