製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Mozilla 製品の nsWindow::OnExposeEvent 関数におけるヒープベースのバッファオーバーフローの脆弱性

タイトル	複数の Mozilla 製品の nsWindow::OnExposeEvent 関数におけるヒープベースのバッファオーバーフローの脆弱性
概要	複数の Mozilla 製品の nsWindow::OnExposeEvent 関数には、ヒープベースのバッファオーバーフローの脆弱性が存在します。
想定される影響	第三者により、任意のコードを実行される可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2012年11月20日0:00
登録日	2012年11月22日14:49
最終更新日	2013年8月27日18:20

CVSS2.0 : 危険
スコア	10
ベクター	AV:N/AC:L/Au:N/C:C/I:C/A:C

影響を受けるシステム

Mozilla Foundation

Mozilla Firefox 18.0 未満

Mozilla Firefox ESR 10.0.11 未満の 10.x

Mozilla SeaMonkey 2.15 未満

Mozilla Thunderbird 17.0.2 未満

Mozilla Thunderbird ESR 10.0.11 未満の 10.x

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-5829	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5829
National Vulnerability Database (NVD)
2	CVE-2012-5829	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5829

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	名前	URL
Debian Security Advisory
1	DSA-2583	http://www.debian.org/security/2012/dsa-2583
2	DSA-2584	http://www.debian.org/security/2012/dsa-2584
Mozilla Foundation Security Advisory
3	MFSA2012-105	http://www.mozilla.org/security/announce/2012/mfsa2012-105.html
4	MFSA2013-02	http://www.mozilla.org/security/announce/2013/mfsa2013-02.html
Mozilla Foundation セキュリティアドバイザリ
5	MFSA2012-105	http://www.mozilla-japan.org/security/announce/2012/mfsa2012-105.html
6	MFSA2013-02	http://www.mozilla-japan.org/security/announce/2013/mfsa2013-02.html
opensuse-updates
7	openSUSE-SU-2012:1583	http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
8	openSUSE-SU-2012:1585	http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html
9	openSUSE-SU-2012:1586	http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html
Red Hat Security Advisory
10	RHSA-2012:1482	http://rhn.redhat.com/errata/RHSA-2012-1482.html
11	RHSA-2012:1483	http://rhn.redhat.com/errata/RHSA-2012-1483.html
Security Advisories
12	MDVSA-2012:173	http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2012:173/?name=MDVSA-2012:173
Ubuntu Security Notice
13	USN-1638-1	http://www.ubuntu.com/usn/USN-1638-1/
14	USN-1638-2	http://www.ubuntu.com/usn/USN-1638-2
15	USN-1638-3	http://www.ubuntu.com/usn/USN-1638-3

変更履歴

No	変更内容	変更日
0	[2012年11月22日] 掲載 [2012年12月07日] CVSS による深刻度：基本値と機密性への影響、完全性への影響、可用性への影響を更新ベンダ情報：openSUSE (openSUSE-SU-2012:1583) を追加ベンダ情報：openSUSE (openSUSE-SU-2012:1585) を追加ベンダ情報：openSUSE (openSUSE-SU-2012:1586) を追加ベンダ情報：Ubuntu (USN-1638-1) を追加 [2013年01月15日] 影響を受けるシステム：Mozilla Foundation (MFSA2013-02) の情報を更新ベンダ情報：Mozilla Foundation (MFSA2013-02) を追加 [2013年01月24日] ベンダ情報：レッドハット (RHSA-2012:1482) を追加ベンダ情報：レッドハット (RHSA-2012:1483) を追加ベンダ情報：Ubuntu (USN-1638-2) を追加ベンダ情報：Ubuntu (USN-1638-3) を追加ベンダ情報：Debian (DSA-2583) を追加ベンダ情報：Debian (DSA-2584) を追加 [2013年08月27日] ベンダ情報：Mandriva, Inc. (MDVSA-2012:173) を追加	2018年2月17日10:37

NVD脆弱性情報

CVE-2012-5829

概要	Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors.
公表日	2012年11月21日21:55
登録日	2021年1月28日15:06
最終更新日	2024年11月21日10:45

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:mozilla:firefox::::::::				17.0
cpe:2.3:a:mozilla:seamonkey::::::::				2.14
cpe:2.3:a:mozilla:thunderbird::::::::				17.0
cpe:2.3:a:mozilla:thunderbird_esr::::::::	10.0			10.0.11
cpe:2.3:a:mozilla:firefox::::::::	10.0			10.0.11

構成2	以上	以下	より上	未満
cpe:2.3:o:suse:linux_enterprise_server:10:sp4::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2::::::
cpe:2.3:o:opensuse:opensuse:11.4:::::::*
cpe:2.3:o:opensuse:opensuse:12.2:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4::::::
cpe:2.3:o:opensuse:opensuse:12.1:::::::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::vmware::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4::::::

構成3	以上	以下	より上	未満
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:6.3:::::::*

構成4	以上	以下	より上	未満
cpe:2.3:o:canonical:ubuntu_linux:11.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::

構成5	以上	以下	より上	未満
cpe:2.3:o:debian:debian_linux:7.0:::::::*
cpe:2.3:o:debian:debian_linux:6.0:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html	Mailing List Third Party Advisory
9	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html	Mailing List Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html	Mailing List Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html	Mailing List Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html	Mailing List Third Party Advisory
13	http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html	Mailing List Third Party Advisory
14	http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html	Mailing List Third Party Advisory
15	http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html	Mailing List Third Party Advisory
16	http://lists.opensuse.org/opensuse-updates/2012-11/msg00092.html	Mailing List Third Party Advisory
17	http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html	Mailing List Third Party Advisory
18	http://lists.opensuse.org/opensuse-updates/2012-11/msg00093.html	Mailing List Third Party Advisory
19	http://osvdb.org/87608	Broken Link
20	http://osvdb.org/87608	Broken Link
21	http://rhn.redhat.com/errata/RHSA-2012-1482.html	Third Party Advisory
22	http://rhn.redhat.com/errata/RHSA-2012-1482.html	Third Party Advisory
23	http://rhn.redhat.com/errata/RHSA-2012-1483.html	Third Party Advisory
24	http://rhn.redhat.com/errata/RHSA-2012-1483.html	Third Party Advisory
25	http://secunia.com/advisories/51359	Third Party Advisory
26	http://secunia.com/advisories/51359	Third Party Advisory
27	http://secunia.com/advisories/51360	Third Party Advisory
28	http://secunia.com/advisories/51360	Third Party Advisory
29	http://secunia.com/advisories/51369	Third Party Advisory
30	http://secunia.com/advisories/51369	Third Party Advisory
31	http://secunia.com/advisories/51370	Third Party Advisory
32	http://secunia.com/advisories/51370	Third Party Advisory
33	http://secunia.com/advisories/51381	Third Party Advisory
34	http://secunia.com/advisories/51381	Third Party Advisory
35	http://secunia.com/advisories/51434	Third Party Advisory
36	http://secunia.com/advisories/51434	Third Party Advisory
37	http://secunia.com/advisories/51439	Third Party Advisory
38	http://secunia.com/advisories/51439	Third Party Advisory
39	http://secunia.com/advisories/51440	Third Party Advisory
40	http://secunia.com/advisories/51440	Third Party Advisory
41	http://www.debian.org/security/2012/dsa-2583	Third Party Advisory
42	http://www.debian.org/security/2012/dsa-2583	Third Party Advisory
43	http://www.debian.org/security/2012/dsa-2584	Third Party Advisory
44	http://www.debian.org/security/2012/dsa-2584	Third Party Advisory
45	http://www.debian.org/security/2012/dsa-2588	Third Party Advisory
46	http://www.debian.org/security/2012/dsa-2588	Third Party Advisory
47	http://www.mandriva.com/security/advisories?name=MDVSA-2012:173	Third Party Advisory
48	http://www.mandriva.com/security/advisories?name=MDVSA-2012:173	Third Party Advisory
49	http://www.mozilla.org/security/announce/2012/mfsa2012-105.html	Not Applicable
50	http://www.mozilla.org/security/announce/2012/mfsa2012-105.html	Not Applicable
51	http://www.mozilla.org/security/announce/2013/mfsa2013-02.html	Vendor Advisory
52	http://www.mozilla.org/security/announce/2013/mfsa2013-02.html	Vendor Advisory
53	http://www.securityfocus.com/bid/56636	Third Party Advisory VDB Entry
54	http://www.securityfocus.com/bid/56636	Third Party Advisory VDB Entry
55	http://www.ubuntu.com/usn/USN-1636-1	Third Party Advisory
56	http://www.ubuntu.com/usn/USN-1636-1	Third Party Advisory
57	http://www.ubuntu.com/usn/USN-1638-1	Third Party Advisory
58	http://www.ubuntu.com/usn/USN-1638-1	Third Party Advisory
59	http://www.ubuntu.com/usn/USN-1638-2	Third Party Advisory
60	http://www.ubuntu.com/usn/USN-1638-2	Third Party Advisory
61	http://www.ubuntu.com/usn/USN-1638-3	Third Party Advisory
62	http://www.ubuntu.com/usn/USN-1638-3	Third Party Advisory
63	http://www.ubuntu.com/usn/USN-1681-1	Third Party Advisory
64	http://www.ubuntu.com/usn/USN-1681-1	Third Party Advisory
65	http://www.ubuntu.com/usn/USN-1681-2	Third Party Advisory
66	http://www.ubuntu.com/usn/USN-1681-2	Third Party Advisory
67	http://www.ubuntu.com/usn/USN-1681-4	Third Party Advisory
68	http://www.ubuntu.com/usn/USN-1681-4	Third Party Advisory
69	https://bugzilla.mozilla.org/show_bug.cgi?id=792305	Exploit Issue Tracking Patch Vendor Advisory
70	https://bugzilla.mozilla.org/show_bug.cgi?id=792305	Exploit Issue Tracking Patch Vendor Advisory
71	https://exchange.xforce.ibmcloud.com/vulnerabilities/80195	Third Party Advisory VDB Entry
72	https://exchange.xforce.ibmcloud.com/vulnerabilities/80195	Third Party Advisory VDB Entry
73	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16849	Third Party Advisory
74	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16849	Third Party Advisory

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

構成2	以上	以下	より上	未満
cpe:2.3:o:suse:linux_enterprise_server:10:sp4::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2::::::
cpe:2.3:o:opensuse:opensuse:11.4:::::::*
cpe:2.3:o:opensuse:opensuse:12.2:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4::::::
cpe:2.3:o:opensuse:opensuse:12.1:::::::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::vmware::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4::::::

構成3	以上	以下	より上	未満
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:6.3:::::::*