CVE-2012-3976
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not...
4.3 MediumFix available
CVE-2012-3976 is a medium vulnerability (CVSS 4.3) in Mozilla Firefox, published August 29, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.78%, the 78th percentile. Fixed in firefox 0:10.0.7-1.el5_8.
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.
Exploit likelihood
1.78%Down 0.2 points since Feb 4, 2022
What each source reports
NVD Score used
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.
- Record
CVE-2012-3976- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.
- Record
CVE-2012-3976- Updated
- 2026-11-02
EUVDEUVD-2012-3920 No score
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.
- Record
EUVD-2012-3920- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-42j4-67r4-889f No score
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not...
Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12 do not properly handle onLocationChange events during navigation between different https sites, which allows remote attackers to spoof the X.509 certificate information in the address bar via a crafted web page.
- Record
GHSA-42j4-67r4-889f- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
- mozilla firefox
- mozilla seamonkey
- canonical ubuntu linux
- opensuse
- redhat enterprise linux desktop
- redhat enterprise linux eus
- redhat enterprise linux server
- redhat enterprise linux server eus
- redhat enterprise linux workstation
- suse linux enterprise desktop
- suse linux enterprise server
- suse linux enterprise software development kit
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:5::client |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::client |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
firefoxRed Hat:enterprise_linux:5::server |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::server |
before 0:10.0.7-1.el5_8 | 0:10.0.7-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::server |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xulrunner-debuginfoRed Hat:enterprise_linux:5::server |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::server |
before 0:10.0.7-2.el5_8 | 0:10.0.7-2.el5_8 |
firefoxRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::client |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::computenode |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::server |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::workstation |
before 0:10.0.7-1.el6_3 | 0:10.0.7-1.el6_3 |
MozillaFirefoxopenSUSE:Tumbleweed |
before 50.1.0-1.1 | 50.1.0-1.1 |
firefox-esropenSUSE:Tumbleweed |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
mozilla.org/security/announce/2012/mfsa2012-69.html
bugzilla.mozilla.org/show_bug.cgi?id=768568
ubuntu.com/usn/USN-1548-1
rhn.redhat.com/errata/RHSA-2012-1210.html
lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
Show 194 moreShow less
securityfocus.com/bid/55313
xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16060
nvd.nist.gov/vuln/detail/CVE-2012-3976
github.com/advisories/GHSA-42j4-67r4-889f
access.redhat.com/errata/RHSA-2012:1210
bugzilla.redhat.com/show_bug.cgi?id=851909
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1210.json
cve.org/CVERecord?id=CVE-2012-1970
suse.com/security/cve/CVE-2008-5913
This page doesn't list everything
Left out here: 1,984 references. The JSON record has them.