Cross-Site Scripting Vulnerability in Bugzilla Flash Component by YUI
CVE-2012-5883

Currently unrated

Key Information:

Vendor

Mozilla
Status
Bugzilla
Yui
Vendor
CVE Published:
16 November 2012

What is CVE-2012-5883?

A cross-site scripting vulnerability exists within the Flash component of YUI version 2.8.0 to 2.9.0, utilized in Bugzilla versions 3.7.x and 4.0.x prior to 4.0.9, as well as in versions 4.1.x, 4.2.x, 4.3.x, and 4.4.x before their respective security releases. This vulnerability permits remote attackers to inject arbitrary web scripts or HTML through vectors associated with the swfstore.swf file. This security issue shares similarities with a previously documented vulnerability, posing risks for applications relying on the vulnerable versions.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=808845
x_refsource_CONFIRM
http://www.mandriva.com/security/advisories?name=MDVSA-20...
vendor-advisoryx_refsource_MANDRIVA
http://www.yuiblog.com/blog/2012/11/05/post-mortem-swf-vu...
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.