PT-2009-3841 · Mozilla+1 · Firefox+3

Moz_Bug_R_A4

·

Publicado

2009-04-21

·

Atualizado

2024-12-12

·

CVE-2009-1309

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.9 Thunderbird (affected versions not specified) SeaMonkey (affected versions not specified)
Description The issue is related to the improper implementation of the Same Origin Policy, which can lead to cross-site scripting (XSS) attacks. This is due to two main problems:
  1. A mismatch for a document's principal in XMLHttpRequest, and
  2. An incorrect proto scope in XPCNativeWrapper.toString. This allows remote attackers to conduct attacks via a crafted document.
Recommendations For Mozilla Firefox versions prior to 3.0.9, update to version 3.0.9 or later. For Thunderbird, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For SeaMonkey, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2009-1309
DSA-1797-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
RHSA-2009:0436
RHSA-2009:0437
RHSA-2009:1125
RHSA-2009:1126
RHSA-2009_0436
RHSA-2009_0437
RHSA-2009_1125
RHSA-2009_1126

Produtos afetados

Firefox
Red Hat
Seamonkey
Thunderbird