Security Advisory

CVE-2012-0475

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2012-04-25 10:00:00

Last updated 2024-08-06 18:23:31

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields.

← Browse all CVEs View on cve.org ↗