Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-g2cj-8shy-uqcc
Vulnerability ID VCID-g2cj-8shy-uqcc
Aliases CVE-2012-1941
Summary Security researcher Abhishek Arya of Google used the Address Sanitizer tool to uncover several issues: two heap buffer overflow bugs and a use-after-free problem. The first heap buffer overflow was found in conversion from unicode to native character sets when the function fails. The use-after-free occurs in nsFrameList when working with column layout with absolute positioning in a container that changes size. The second buffer overflow occurs in nsHTMLReflowState when a window is resized on a page with nested columns and a combination of absolute and relative positioning. All three of these issues are potentially exploitable.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-416 Use After Free
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
System Score Found at
epss 0.06289 https://api.first.org/data/v1/epss?cve=CVE-2012-1941
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2012-40
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-1941.json
https://api.first.org/data/v1/epss?cve=CVE-2012-1941
827843 https://bugzilla.redhat.com/show_bug.cgi?id=827843
CVE-2012-1941 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1941
GLSA-201301-01 https://security.gentoo.org/glsa/201301-01
mfsa2012-40 https://www.mozilla.org/en-US/security/advisories/mfsa2012-40
RHSA-2012:0710 https://access.redhat.com/errata/RHSA-2012:0710
RHSA-2012:0715 https://access.redhat.com/errata/RHSA-2012:0715
USN-1463-1 https://usn.ubuntu.com/1463-1/
USN-1463-4 https://usn.ubuntu.com/1463-4/
USN-1463-6 https://usn.ubuntu.com/1463-6/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.91078
EPSS Score 0.06289
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:27:26.932413+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2012/mfsa2012-40.md 38.6.0