CVE-2012-1964
The certificate-warning functionality in browser/components/certerror/content/aboutCertError...
CVE-2012-1964 is a medium vulnerability (CVSS 4.0) in Mozilla Firefox, published July 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. No source names a fixed version.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 0.89%EPSS, 59th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:5::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
firefoxRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xulrunner-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
firefoxRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:5::client From an advisory covering 14 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
thunderbird-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 14 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
thunderbirdRed Hat:rhel_productivity:5 From an advisory covering 14 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
thunderbird-debuginfoRed Hat:rhel_productivity:5 From an advisory covering 14 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
thunderbirdRed Hat:enterprise_linux:6::client From an advisory covering 14 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 14 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:6::server From an advisory covering 14 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 14 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
thunderbirdRed Hat:enterprise_linux:6::workstation From an advisory covering 14 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 14 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
What each source reports
NVD Score used
The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
- Record
CVE-2012-1964- CVSS 2.0
- 4.0 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
- Record
CVE-2012-1964- Updated
- 2026-11-02
EUVDEUVD-2012-1973No score
The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
- Record
EUVD-2012-1973- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-895m-hw9q-p7wjNo score
The certificate-warning functionality in browser/components/certerror/content/aboutCertError...
The certificate-warning functionality in browser/components/certerror/content/aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element.
- Record
GHSA-895m-hw9q-p7wj- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/49977
securityfocus.com/bid/54581
rhn.redhat.com/errata/RHSA-2012-1088.html
bugzilla.mozilla.org/show_bug.cgi?id=633691
ubuntu.com/usn/USN-1509-2
Show 86 moreShow less
lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html
mozilla.org/security/announce/2012/mfsa2012-54.html
osvdb.org/84011
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16783
nvd.nist.gov/vuln/detail/CVE-2012-1964
github.com/advisories/GHSA-895m-hw9q-p7wj
access.redhat.com/errata/RHSA-2012:1088
bugzilla.redhat.com/show_bug.cgi?id=838879
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1088.json
cve.org/CVERecord?id=CVE-2012-1948