Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-nkdg-ez7k-7qdh
Vulnerability ID VCID-nkdg-ez7k-7qdh
Aliases CVE-2012-1940
Summary Security researcher Abhishek Arya of Google used the Address Sanitizer tool to uncover several issues: two heap buffer overflow bugs and a use-after-free problem. The first heap buffer overflow was found in conversion from unicode to native character sets when the function fails. The use-after-free occurs in nsFrameList when working with column layout with absolute positioning in a container that changes size. The second buffer overflow occurs in nsHTMLReflowState when a window is resized on a page with nested columns and a combination of absolute and relative positioning. All three of these issues are potentially exploitable.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-416 Use After Free
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
System Score Found at
epss 0.03035 https://api.first.org/data/v1/epss?cve=CVE-2012-1940
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2012-40
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-1940.json
https://api.first.org/data/v1/epss?cve=CVE-2012-1940
827843 https://bugzilla.redhat.com/show_bug.cgi?id=827843
CVE-2012-1940 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1940
GLSA-201301-01 https://security.gentoo.org/glsa/201301-01
mfsa2012-40 https://www.mozilla.org/en-US/security/advisories/mfsa2012-40
RHSA-2012:0710 https://access.redhat.com/errata/RHSA-2012:0710
RHSA-2012:0715 https://access.redhat.com/errata/RHSA-2012:0715
USN-1463-1 https://usn.ubuntu.com/1463-1/
USN-1463-4 https://usn.ubuntu.com/1463-4/
USN-1463-6 https://usn.ubuntu.com/1463-6/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.86893
EPSS Score 0.03035
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:27:26.895946+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2012/mfsa2012-40.md 38.6.0