PT-2009-3018 · Mozilla+1 · Firefox+1

Moz_Bug_R_A4 · Publicado 2009-02-04 · Atualizado 2024-12-12 · CVE-2009-0355

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Média

Vetor base

AV:N/AC:H/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.6

Description The issue allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element. This occurs because the nsSessionStore.js component in Mozilla Firefox does not block changes of INPUT elements to type="file" during tab restoration.

Recommendations For versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue. As a temporary workaround, consider avoiding the restoration of tabs from untrusted sources until a patch is applied. Restrict access to file input elements to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0355

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2009:0256

RHSA-2009:0257

RHSA-2009:0258

RHSA-2009_0256

RHSA-2009_0257

RHSA-2009_0258

Produtos afetados

Firefox

Red Hat

Referências · 1905

• https://suse.com/security/cve/CVE-2009-0354 · Nota
• https://suse.com/security/cve/CVE-2024-3302 · Nota
• https://suse.com/security/cve/CVE-2024-1551 · Nota
• https://suse.com/security/cve/CVE-2023-25731 · Nota
• https://suse.com/security/cve/CVE-2009-1307 · Nota
• https://suse.com/security/cve/CVE-2020-6812 · Nota
• https://suse.com/security/cve/CVE-2024-4769 · Nota
• http://secunia.com/advisories/33831 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-5282 · Nota
• https://suse.com/security/cve/CVE-2010-1210 · Nota
• https://suse.com/security/cve/CVE-2023-23601 · Nota
• https://suse.com/security/cve/CVE-2013-0795 · Nota
• https://suse.com/security/cve/CVE-2013-1720 · Nota
• https://suse.com/security/cve/CVE-2011-3650 · Nota
• https://suse.com/security/cve/CVE-2024-5700 · Nota