CVE-2012-0475

Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP…

published April 25, 2012

CVSS
—
EPSS
2%
Percentile
78.8
In the wild
Unconfirmed
What it is

Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01853 · 78.8th percentile
Published
2012-04-25T10:00Z
EPSS history
Timeline
  • 25 APR 10:00Z
    Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP…
    cvelistv5