CVE-2012-1950
The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before...
6.4 Medium
CVE-2012-1950 is a medium vulnerability (CVSS 6.4) in Mozilla Firefox, published July 17, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. No source names a fixed version.
- Severity
- 6.4 MediumCVSS 2.0, NVD
- Exploit chance
- 1.84%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.
Exploit likelihood
1.84%Down 2.5 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceweaselDebian:6.0 From an advisory covering 5 CVEs | before 3.5.16-17, plus listed versions 3.5.16-103.5.16-10~bpo50+13.5.16-113.5.16-11~bpo50+13.5.16-12 Show 14 moreShow less3.5.16-133.5.16-143.5.16-153.5.16-163.5.16-43.5.16-53.5.16-5~bpo50+13.5.16-63.5.16-6~bpo50+13.5.16-73.5.16-7~bpo50+13.5.16-83.5.16-8~bpo50+13.5.16-9 | 3.5.16-17 |
icedoveDebian:6.0 From an advisory covering 4 CVEs | before 3.0.11-1+squeeze12, plus listed versions 3.0.11-13.0.11-1+squeeze13.0.11-1+squeeze103.0.11-1+squeeze113.0.11-1+squeeze2 Show 7 moreShow less3.0.11-1+squeeze33.0.11-1+squeeze43.0.11-1+squeeze53.0.11-1+squeeze63.0.11-1+squeeze73.0.11-1+squeeze83.0.11-1+squeeze9 | 3.0.11-1+squeeze12 |
firefoxRed Hat:enterprise_linux:5::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
firefox-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
firefoxRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefox-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el5_8 | 0:10.0.6-1.el5_8 |
xulrunnerRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
xulrunner-develRed Hat:enterprise_linux:5::server From an advisory covering 17 CVEs | before 0:10.0.6-2.el5_8 | 0:10.0.6-2.el5_8 |
firefoxRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::client From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::computenode From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::server From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefoxRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunnerRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
xulrunner-develRed Hat:enterprise_linux:6::workstation From an advisory covering 17 CVEs | before 0:10.0.6-1.el6_3 | 0:10.0.6-1.el6_3 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 899 CVEs | before 50.1.0-1.1 | 50.1.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs | before 128.5.1-1.1 | 128.5.1-1.1 |
What each source reports
NVD Score used
The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.
- Record
CVE-2012-1950- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.
- Record
CVE-2012-1950- Updated
- 2026-11-02
EUVDEUVD-2012-1959No score
The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.
- Record
EUVD-2012-1959- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wqgg-q2mf-p44hNo score
The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before...
The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load.
- Record
GHSA-wqgg-q2mf-p44h- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/49992
mozilla.org/security/announce/2012/mfsa2012-43.html
debian.org/security/2012/dsa-2514
bugzilla.mozilla.org/show_bug.cgi?id=724599
securitytracker.com/id?1027256
Show 194 moreShow less
rhn.redhat.com/errata/RHSA-2012-1088.html
ubuntu.com/usn/USN-1509-2
lists.opensuse.org/opensuse-security-announce/2012-07/msg00011.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16970
osvdb.org/84008
nvd.nist.gov/vuln/detail/CVE-2012-1950
github.com/advisories/GHSA-wqgg-q2mf-p44h
access.redhat.com/errata/RHSA-2012:1088
bugzilla.redhat.com/show_bug.cgi?id=838879
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1088.json
cve.org/CVERecord?id=CVE-2012-1948
suse.com/security/cve/CVE-2008-5913
This page doesn't list everything
Left out here: 1,947 references. The JSON record has them.