CVE-2012-3988
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8,...
9.3 HighFix available
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
Exploit likelihood
5.20%Down 4.7 points since Feb 4, 2022
What each source reports
NVD Score used
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
- Record
CVE-2012-3988- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
- Record
CVE-2012-3988- Updated
- 2026-11-02
EUVDEUVD-2012-3932 No score
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
- Record
EUVD-2012-3932- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wc4c-2hhq-9f86 No score
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8,...
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
- Record
GHSA-wc4c-2hhq-9f86- Weakness
- CWE-416
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
- mozilla firefox
- mozilla seamonkey
- mozilla thunderbird
- mozilla thunderbird esr
- canonical ubuntu linux
- redhat enterprise linux desktop
- redhat enterprise linux eus
- redhat enterprise linux server
- redhat enterprise linux workstation
- suse linux enterprise desktop
- suse linux enterprise sdk
- suse linux enterprise server
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:5::client |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::client |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
firefoxRed Hat:enterprise_linux:5::server |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::server |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::server |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
Show 35 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xulrunner-debuginfoRed Hat:enterprise_linux:5::server |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::server |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
firefoxRed Hat:enterprise_linux:6::client |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::client |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::client |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::client |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::client |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::computenode |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::computenode |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::computenode |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::server |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::server |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::server |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::server |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::workstation |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::workstation |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::workstation |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:5::client |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
thunderbird-debuginfoRed Hat:enterprise_linux:5::client |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
thunderbirdRed Hat:rhel_productivity:5 |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
thunderbird-debuginfoRed Hat:rhel_productivity:5 |
before 0:10.0.8-1.el5_8 | 0:10.0.8-1.el5_8 |
thunderbirdRed Hat:enterprise_linux:6::client |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::client |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:6::server |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::server |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:6::workstation |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:10.0.8-1.el6_3 | 0:10.0.8-1.el6_3 |
MozillaFirefoxopenSUSE:Tumbleweed |
before 50.1.0-1.1 | 50.1.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed |
before 45.5.1-1.1 | 45.5.1-1.1 |
firefox-esropenSUSE:Tumbleweed |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3988 is a high vulnerability (CVSS 9.3) in Mozilla Firefox, published October 10, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.20%, the 92nd percentile. Fixed in firefox 0:10.0.8-1.el5_8.
References
secunia.com/advisories/50904
exchange.xforce.ibmcloud.com/vulnerabilities/79149
Show 194 moreShow less
rhn.redhat.com/errata/RHSA-2012-1351.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16334
osvdb.org/86109
bugzilla.mozilla.org/show_bug.cgi?id=725770
lists.opensuse.org/opensuse-security-announce/2012-10/msg00010.html
mandriva.com/security/advisories?name=MDVSA-2012:163
mozilla.org/security/announce/2012/mfsa2012-79.html
ubuntu.com/usn/USN-1611-1
nvd.nist.gov/vuln/detail/CVE-2012-3988
github.com/advisories/GHSA-wc4c-2hhq-9f86
access.redhat.com/errata/RHSA-2012:1350
bugzilla.redhat.com/show_bug.cgi?id=851912
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1350.json
cve.org/CVERecord?id=CVE-2012-1956
suse.com/security/cve/CVE-2008-5913
This page doesn't list everything
Left out here: 2,003 references. The JSON record has them.