CVE-2012-5354

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has multiple menus of SELECT elements active, which allows remote attackers to conduct clickjacking attacks via vectors involving an XPI file, the window.open method, and the Geolocation API, a different vulnerability than CVE-2012-3984.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/86171Broken Link
http://secunia.com/advisories/50856Broken Link
http://secunia.com/advisories/50935Broken Link
http://www.mozilla.org/security/announce/2012/mfsa2012-75.htmlVendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=726264Issue Tracking, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16972Third Party Advisory
http://osvdb.org/86171Broken Link
http://secunia.com/advisories/50856Broken Link
http://secunia.com/advisories/50935Broken Link
http://www.mozilla.org/security/announce/2012/mfsa2012-75.htmlVendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=726264Issue Tracking, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16972Third Party Advisory

Timeline

Published: Oct 10, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-53553.3welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with CVE-2012-53565.8The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x b CVE-2012-53579.8Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remot CVE-2012-53589.8The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction CVE-2012-53598.8Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file.CVE-2012-53608.8Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file.CVE-2012-53617.8Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file.CVE-2012-53627.5The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighb CVE-2012-53637.5The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service CVE-2012-53647.5The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router CVE-2012-53657.5The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service CVE-2012-53667.5The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via