Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2012-04-25T10:00:00

Updated: 2024-08-06T18:23:31.021Z

Reserved: 2012-01-09T00:00:00

Link: CVE-2012-0475

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2012-04-25T10:10:17.683

Modified: 2017-12-19T02:29:38.847

Link: CVE-2012-0475

cve-icon Redhat

Severity :

Publid Date: 2012-04-24T00:00:00Z

Links: CVE-2012-0475 - Bugzilla