Every CVE Search/ Get API key

CVE-2012-4929

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other...

2.6 LowPublic exploitFix available

CVE-2012-4929 is a low vulnerability (CVSS 2.6) in Google Chrome, published September 15, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.35%, the 91st percentile. Fixed in apache2 2.2.22-12.

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Exploit likelihood

4.35%Down 13.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 2.6

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
CVE-2012-4929
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:P/I:N/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
CVE-2012-4929
Updated
2026-11-02
EUVDEUVD-2012-4854 No score

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
EUVD-2012-4854
Updated
2026-11-03
GitHub AdvisoriesGHSA-348j-44v2-vwfr No score

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other...

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
GHSA-348j-44v2-vwfr
Updated
2026-11-02
OSV No score

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
CVE-2012-4929
Updated
2026-11-02
OSVDEBIAN-CVE-2012-4929 No score

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Record
DEBIAN-CVE-2012-4929
Updated
2026-11-02
Show 9 moreShow less
OSVopenSUSE-SU-2024:10180-1 No score

libqt4-32bit-4.8.7-5.4 on GA media

These are all security issues fixed in the libqt4-32bit-4.8.7-5.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10180-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10235-1 No score

w3m-0.5.3.git20161120-1.1 on GA media

These are all security issues fixed in the w3m-0.5.3.git20161120-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10235-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10263-1 No score

wget-1.18-2.3 on GA media

These are all security issues fixed in the wget-1.18-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10263-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10329-1 No score

lynx-2.8.8rel.2-4.13 on GA media

These are all security issues fixed in the lynx-2.8.8rel.2-4.13 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10329-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10531-1 No score

links-2.13-1.3 on GA media

These are all security issues fixed in the links-2.13-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10531-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Debian:12
 before 2.2.22-12
2.2.22-12
apache2
Debian:13
 before 2.2.22-12
2.2.22-12
apache2
Debian:14
 before 2.2.22-12
2.2.22-12
lighttpd
Debian:12
 before 1.4.30-1
1.4.30-1
lighttpd
Debian:13
 before 1.4.30-1
1.4.30-1
lighttpd
Debian:14
 before 1.4.30-1
1.4.30-1
nginx
Debian:12
 before 1.2.1-2.2
1.2.1-2.2
nginx
Debian:13
 before 1.2.1-2.2
1.2.1-2.2
nginx
Debian:14
 before 1.2.1-2.2
1.2.1-2.2
openssl
Debian:12
 before 1.0.1e-5
1.0.1e-5
Show 46 moreShow less
Affected packages
PackageAffectedFixed
openssl
Debian:13
 before 1.0.1e-5
1.0.1e-5
openssl
Debian:14
 before 1.0.1e-5
1.0.1e-5
pound
Debian:13
 before 2.6-3
2.6-3
pound
Debian:14
 before 2.6-3
2.6-3
openssl
Debian:6.0
 before 0.9.8o-4squeeze16, plus listed versions
0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13
Show 10 moreShow less
0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9
0.9.8o-4squeeze16
pound
Debian:6.0
 before 2.6-1+deb6u1, plus listed versions
2.5-12.5-1.12.6-1
2.6-1+deb6u1
apache2
Debian:6.0
 before 2.2.16-6+squeeze10, plus listed versions
2.2.16-62.2.16-6+squeeze12.2.16-6+squeeze1~bpo50+12.2.16-6+squeeze22.2.16-6+squeeze2~bpo50+1
Show 6 moreShow less
2.2.16-6+squeeze32.2.16-6+squeeze42.2.16-6+squeeze4~bpo50+12.2.16-6+squeeze62.2.16-6+squeeze72.2.16-6+squeeze8
2.2.16-6+squeeze10
lighttpd
Debian:6.0
 before 1.4.28-2+squeeze1.2, plus listed versions
1.4.28-21.4.28-2+squeeze11.4.28-2+squeeze1.1
1.4.28-2+squeeze1.2
nginx
Debian:6.0
 before 0.7.67-3+squeeze3, plus listed versions
0.7.67-30.7.67-3+squeeze10.7.67-3+squeeze2
0.7.67-3+squeeze3
pound
Debian:7
 before 2.6-2+deb7u1, plus listed versions
2.6-2
2.6-2+deb7u1
pound
Debian:8
 before 2.6-6+deb8u1, plus listed versions
2.6-6
2.6-6+deb8u1
openssl
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-26.el5_9.1
0:0.9.8e-26.el5_9.1
openssl-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-26.el5_9.1
0:0.9.8e-26.el5_9.1
openssl-devel
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-26.el5_9.1
0:0.9.8e-26.el5_9.1
openssl-perl
Red Hat:enterprise_linux:5::server
 before 0:0.9.8e-26.el5_9.1
0:0.9.8e-26.el5_9.1
openssl
Red Hat:enterprise_linux:6::client
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-devel
Red Hat:enterprise_linux:6::client
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-perl
Red Hat:enterprise_linux:6::client
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-static
Red Hat:enterprise_linux:6::client
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-perl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-static
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl
Red Hat:enterprise_linux:6::server
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-devel
Red Hat:enterprise_linux:6::server
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-perl
Red Hat:enterprise_linux:6::server
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-static
Red Hat:enterprise_linux:6::server
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-perl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
openssl-static
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.0-27.el6_4.2
0:1.0.0-27.el6_4.2
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
 before 0:6.4-20130306.2.el6_4
0:6.4-20130306.2.el6_4
rhevm-spice-client
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
rhevm-spice-client-x64-cab
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
rhevm-spice-client-x64-msi
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
rhevm-spice-client-x86-cab
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
rhevm-spice-client-x86-msi
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
w3m
openSUSE:Tumbleweed
 before 0.5.3.git20161120-1.1
0.5.3.git20161120-1.1
wget
openSUSE:Tumbleweed
 before 1.18-2.3
1.18-2.3
lynx
openSUSE:Tumbleweed
 before 2.8.8rel.2-4.13
2.8.8rel.2-4.13
links
openSUSE:Tumbleweed
 before 2.13-1.3
2.13-1.3
openssl-1_1
openSUSE:Tumbleweed
 before 1.1.1l-1.2
1.1.1l-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubanthophilee/A2SV--SSL-VUL-Scan2021-01-01
PoC in GitHubmpgn/CRIME-poc2018-04-21

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 599 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open