CVE-2012-5883
NONE EPSS 79.5%
Published Nov 16, 201213y ago · Modified Jun 16, 20262w ago
Published Nov 16, 2012 13y ago
Last Modified Jun 16, 2026 2w ago
Description
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore.swf, a similar issue to CVE-2010-4209.
Threat Intelligence
EPSS Exploit Probability
79.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 36
| Vendor | Product | Version | Range |
|---|---|---|---|
| mozilla | bugzilla | 3.7 | any |
| mozilla | bugzilla | 3.7.1 | any |
| mozilla | bugzilla | 3.7.2 | any |
| mozilla | bugzilla | 3.7.3 | any |
| mozilla | bugzilla | 4.0 | any |
| mozilla | bugzilla | 4.0 | any |
| mozilla | bugzilla | 4.0 | any |
| mozilla | bugzilla | 4.0.1 | any |
| mozilla | bugzilla | 4.0.2 | any |
| mozilla | bugzilla | 4.0.3 | any |
| mozilla | bugzilla | 4.0.4 | any |
| mozilla | bugzilla | 4.0.5 | any |
| mozilla | bugzilla | 4.0.6 | any |
| mozilla | bugzilla | 4.0.7 | any |
| mozilla | bugzilla | 4.0.8 | any |
| mozilla | bugzilla | 4.1 | any |
| mozilla | bugzilla | 4.1.1 | any |
| mozilla | bugzilla | 4.1.2 | any |
| mozilla | bugzilla | 4.1.3 | any |
| mozilla | bugzilla | 4.2 | any |
| mozilla | bugzilla | 4.2 | any |
| mozilla | bugzilla | 4.2 | any |
| mozilla | bugzilla | 4.2.1 | any |
| mozilla | bugzilla | 4.2.2 | any |
| mozilla | bugzilla | 4.2.3 | any |
| mozilla | bugzilla | 4.3 | any |
| mozilla | bugzilla | 4.3.1 | any |
| mozilla | bugzilla | 4.3.2 | any |
| mozilla | bugzilla | 4.3.3 | any |
| yahoo | yui | 2.8.0 | any |
| yahoo | yui | 2.8.1 | any |
| yahoo | yui | 2.8.1 | any |
| yahoo | yui | 2.8.2 | any |
| yahoo | yui | 2.9.0 | any |
| yahoo | yui | 2.9.0 | any |
| yahoo | yui | 2.9.0 | any |
References 8
- bugzilla.org http://www.bugzilla.org/security/3.6.11/
- mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2013:066
- securityfocus.com http://www.securityfocus.com/bid/56385
- yuiblog.com http://www.yuiblog.com/blog/2012/10/30/security-announcement-swf-vulnerability-in-yui-2/
- yuiblog.com http://www.yuiblog.com/blog/2012/11/05/post-mortem-swf-vulnerability-in-yui-2/
- yuilibrary.com http://yuilibrary.com/support/20121030-vulnerability/
- bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=808845
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/80116
Remediation
- yuilibrary.com http://yuilibrary.com/support/20121030-vulnerability/