Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields.
History

No history.

cve-icon MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2012-04-25T10:00:00

Updated: 2017-12-18T19:57:01

Reserved: 2012-01-09T00:00:00


Link: CVE-2012-0475

JSON object: View

cve-icon NVD Information

Status : Modified

Published: 2012-04-25T10:10:17.683

Modified: 2017-12-19T02:29:38.847


Link: CVE-2012-0475

JSON object: View

cve-icon Redhat Information

No data.

CWE