Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.…

published 2012-11-21 13 y ago modified 2026-06-16 4 mo ago also EUVD-2012-5721

cvss: 9.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 5.8%; EPSS 5.8% chance of exploitation in 30 days, percentile 93%
public exploits: 0; none known

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Patch / fix

fixed in 4 distros 1 links 10

mozilla firefox 10.0.11, 17.0
mozilla seamonkey 2.14
mozilla thunderbird 17.0
mozilla thunderbird_esr 10.0.11

MozillaFirefox openSUSE Tumbleweed 50.1.0-1.1
MozillaThunderbird openSUSE Tumbleweed 45.5.1-1.1

opensuse advisories openSUSE-SU-2024:10071-1 openSUSE-SU-2024:10230-1

bugzilla.mozilla.org/show_bug.cgi?id=789075 patch
bugzilla.mozilla.org/show_bug.cgi?id=793253 advisory
bugzilla.mozilla.org/show_bug.cgi?id=784404 advisory
bugzilla.mozilla.org/show_bug.cgi?id=774953 advisory
bugzilla.mozilla.org/show_bug.cgi?id=798678 advisory
bugzilla.mozilla.org/show_bug.cgi?id=788822 advisory
bugzilla.mozilla.org/show_bug.cgi?id=795281 advisory
bugzilla.mozilla.org/show_bug.cgi?id=780778 advisory
bugzilla.mozilla.org/show_bug.cgi?id=781859 advisory
bugzilla.mozilla.org/show_bug.cgi?id=791601 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-5843 updated 2026-11-04 cvss 6.8

Mozilla: Miscellaneous memory safety hazards (rv:17.0) (MFSA 2012-91)

Red Hat Enterprise Linux 5 firefox, thunderbird Red Hat Enterprise Linux 6 firefox, thunderbird
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

5.78% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=788822 referenced PoC, tagged "exploit" by a source, unverified
bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=781859 referenced PoC, tagged "exploit" by a source, unverified
bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=791601 referenced PoC, tagged "exploit" by a source, unverified
bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=797163 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

References

bugzilla.mozilla.org /show_bug.cgi?id=789075
issue-tracking, patch
bugzilla.mozilla.org /show_bug.cgi?id=793253
issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=784404
issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=774953
issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=798678
issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=788822
exploit, issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=795281
issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=780778
issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=781859
exploit, issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=791601
exploit, issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=787089
issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=765409
issue-tracking, patch, vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=797163
exploit, issue-tracking, vendor-advisory
ubuntu.com /usn/USN-1638-3
vendor-advisory, third-party-advisory
ubuntu.com /usn/USN-1638-2
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-updates/2012-11/msg00093.html
vendor-advisory, mailing-list, third-party-advisory
ubuntu.com /usn/USN-1636-1
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2013-01/msg00022.html
vendor-advisory, mailing-list, third-party-advisory
lists.opensuse.org /opensuse-updates/2012-11/msg00090.html
vendor-advisory, mailing-list, third-party-advisory
ubuntu.com /usn/USN-1638-1
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2012-11/msg00021.html
vendor-advisory, mailing-list, third-party-advisory
lists.opensuse.org /opensuse-updates/2012-11/msg00092.html
vendor-advisory, mailing-list, third-party-advisory
bugzilla.mozilla.org /show_bug.cgi?id=760887
issue-tracking, vendor-advisory
mozilla.org /security/announce/2012/mfsa2012-91.html
vendor-advisory
secunia.com /advisories/51370
third-party-advisory
secunia.com /advisories/51434
third-party-advisory
secunia.com /advisories/51439
third-party-advisory
secunia.com /advisories/51440
third-party-advisory
secunia.com /advisories/51381
third-party-advisory
secunia.com /advisories/51369
third-party-advisory
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16839
vdb-entry, signature, third-party-advisory

Sources

CVE List CVE-2012-5843
NVD CVE-2012-5843

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary