PT-2009-5060 · Mozilla · Firefox

Wladimir Palant · Publicado 2009-08-04 · Atualizado 2009-09-04 · CVE-2009-2665

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.5.x through 3.5.1

Description The issue arises from the nsDocument::SetScriptGlobalObject function in Mozilla Firefox, which does not properly handle a Link HTTP header when certain add-ons are enabled. This allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted web page, due to an incorrect security wrapper.

Recommendations For Mozilla Firefox versions 3.5.x through 3.5.1, update to version 3.5.2 or later to resolve the issue.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-2665

Produtos afetados

Firefox

Referências · 9

• http://mozilla.org/security/announce/2009/mfsa2009-46.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/2142 · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=498897 · Nota
• http://securityfocus.com/bid/35928 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2665 · Nota de Segurança
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00261.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00198.html · Aviso do Fabricante
• http://secunia.com/advisories/36126 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1 · Aviso do Fabricante