CVE-2012-0464— Mozilla Firefox/Thunderbird/SeaMonkey任意代码执行漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

n/a n/a

利用判断

利用概率较高，应尽快评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Mozilla Mozilla Firefox是美国Mozilla基金会开发的一款开源Web浏览器。 Mozilla Firefox 3.6.28之前版本、4.x至10.0版本，Firefox ESR 10.0.3之前的10.x版本，Thunderbird 3.1.20之前版本、5.0至10.0版本，Thunderbird ESR 10.0.3之前的10.x版本，与SeaMonkey 2.8之前版本的浏览器引擎中存在释放后使用漏洞。远程攻击者可利用该漏洞执行任意代码。

CVE-2012-0464 影响 n/a n/a。利用概率较高，应尽快评估。Mozilla Mozilla Firefox是美国Mozilla基金会开发的一款开源Web浏览器。 Mozilla Firefox 3.6.28之前版本、4.x至10.0版本，Firefox ESR 10.0.3之前的10.x版本，Thunderbird 3.1.20之前版本、5.0至10.0版本，Thunderbird ESR 10.0.3之前的10.x CVE-2012-0464 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2012-0464

一、 漏洞 CVE-2012-0464 基础信息

受影响产品

二、漏洞 CVE-2012-0464 的公开POC

三、漏洞 CVE-2012-0464 的情报信息

CVE-2012-0464 厂商安全公告 (27)

• https://bugzilla.mozilla.org/show_bug.cgi?id=735104 x_refsource_CONFIRM
• https://bugzilla.mozilla.org/show_bug.cgi?id=720079 x_refsource_CONFIRM
• http://www.mozilla.org/security/announce/2012/mfsa2012-19.html x_refsource_CONFIRM
• http://secunia.com/advisories/48624 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48496 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48359 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48495 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48402 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48513 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/52465 vdb-entry x_refsource_BID
• http://secunia.com/advisories/48629 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48561 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48414 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48823 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1026801 vdb-entry x_refsource_SECTRACK
• http://www.securitytracker.com/id?1026803 vdb-entry x_refsource_SECTRACK
• http://www.securitytracker.com/id?1026804 vdb-entry x_refsource_SECTRACK
• http://www.ubuntu.com/usn/USN-1400-1 vendor-advisory x_refsource_UBUNTU
• http://www.ubuntu.com/usn/USN-1400-4 vendor-advisory x_refsource_UBUNTU
• http://www.ubuntu.com/usn/USN-1400-5 vendor-advisory x_refsource_UBUNTU
• http://www.ubuntu.com/usn/USN-1400-3 vendor-advisory x_refsource_UBUNTU
• http://www.ubuntu.com/usn/USN-1401-1 vendor-advisory x_refsource_UBUNTU
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:032 vendor-advisory x_refsource_MANDRIVA
• http://rhn.redhat.com/errata/RHSA-2012-0388.html vendor-advisory x_refsource_REDHAT
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:031 vendor-advisory x_refsource_MANDRIVA
• http://rhn.redhat.com/errata/RHSA-2012-0387.html vendor-advisory x_refsource_REDHAT
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14170 vdb-entry signature x_refsource_OVAL

CVE-2012-0464 邮件列表归档 (3)

• http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00014.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00015.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-updates/2012-03/msg00042.html vendor-advisory x_refsource_SUSE

CVE-2012-0464 新闻报道 (2)

• http://www.zdnet.com/blog/security/researchers-hack-into-newest-firefox-with-zero-day-flaw/10663 x_refsource_MISC
• http://www.zdnet.com/blog/security/mozilla-knew-of-pwn2own-bug-before-cansecwest/10757 x_refsource_MISC

CVE-2012-0464 其他参考 (1)

• http://pwn2own.zerodayinitiative.com/status.html x_refsource_MISC

• https://www.cve.org/CVERecord?id=CVE-2012-0464

同批安全公告 · n/a · 2012-03-14 · 共 25 条

显示前 20 条，共 25 条。 查看全部 → →

IV. Related Vulnerabilities

V. Comments for CVE-2012-0464