CVE-2012-3969
Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0,...
9.3 HighFix available
CVE-2012-3969 is a high vulnerability (CVSS 9.3) in Mozilla Firefox, published August 29, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.81%, the 91st percentile. Fixed in iceweasel 3.5.16-18.
Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect sum calculation, leading to a heap-based buffer overflow.
Exploit likelihood
4.81%Down 5.1 points since Feb 4, 2022
What each source reports
NVD Score used
Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect sum calculation, leading to a heap-based buffer overflow.
- Record
CVE-2012-3969- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect sum calculation, leading to a heap-based buffer overflow.
- Record
CVE-2012-3969- Updated
- 2026-11-02
EUVDEUVD-2012-3913 No score
Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect sum calculation, leading to a heap-based buffer overflow.
- Record
EUVD-2012-3913- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h64v-9hp2-5crq No score
Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0,...
Integer overflow in the nsSVGFEMorphologyElement::Filter function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via a crafted SVG filter that triggers an incorrect sum calculation, leading to a heap-based buffer overflow.
- Record
GHSA-h64v-9hp2-5crq- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceweaselDebian:6.0 |
before 3.5.16-18, plus listed versions 3.5.16-103.5.16-10~bpo50+13.5.16-113.5.16-11~bpo50+13.5.16-12 Show 15 moreShow less3.5.16-133.5.16-143.5.16-153.5.16-163.5.16-173.5.16-43.5.16-53.5.16-5~bpo50+13.5.16-63.5.16-6~bpo50+13.5.16-73.5.16-7~bpo50+13.5.16-83.5.16-8~bpo50+13.5.16-9 |
3.5.16-18 |
iceapeDebian:6.0 |
before 2.0.11-15, plus listed versions 2.0.11-102.0.11-112.0.11-122.0.11-132.0.11-14 Show 8 moreShow less2.0.11-22.0.11-32.0.11-42.0.11-52.0.11-62.0.11-72.0.11-82.0.11-9 |
2.0.11-15 |
icedoveDebian:6.0 |
before 3.0.11-1+squeeze13, plus listed versions 3.0.11-13.0.11-1+squeeze13.0.11-1+squeeze103.0.11-1+squeeze113.0.11-1+squeeze12 Show 8 moreShow less3.0.11-1+squeeze23.0.11-1+squeeze33.0.11-1+squeeze43.0.11-1+squeeze53.0.11-1+squeeze63.0.11-1+squeeze73.0.11-1+squeeze83.0.11-1+squeeze9 |
3.0.11-1+squeeze13 |
firefoxRed Hat:enterprise_linux:5::client |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::client |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:5::server |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::server |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::server |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::server |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
firefoxRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:5::client |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
thunderbird-debuginfoRed Hat:enterprise_linux:5::client |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
thunderbirdRed Hat:rhel_productivity:5 |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
thunderbird-debuginfoRed Hat:rhel_productivity:5 |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
thunderbirdRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
MozillaFirefoxopenSUSE:Tumbleweed |
before 50.1.0-1.1 | 50.1.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed |
before 45.5.1-1.1 | 45.5.1-1.1 |
firefox-esropenSUSE:Tumbleweed |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2012/dsa-2556
securityfocus.com/bid/55292
rhn.redhat.com/errata/RHSA-2012-1211.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16635
bugzilla.mozilla.org/show_bug.cgi?id=782141
Show 194 moreShow less
mozilla.org/security/announce/2012/mfsa2012-63.html
ubuntu.com/usn/USN-1548-1
lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
nvd.nist.gov/vuln/detail/CVE-2012-3969
github.com/advisories/GHSA-h64v-9hp2-5crq
access.redhat.com/errata/RHSA-2012:1210
bugzilla.redhat.com/show_bug.cgi?id=851909
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1210.json
cve.org/CVERecord?id=CVE-2012-1970
suse.com/security/cve/CVE-2008-5913
This page doesn't list everything
Left out here: 2,003 references. The JSON record has them.