PT-2009-5354 · Mozilla · Firefox+1

Publicado 2009-08-31 · Atualizado 2018-10-10 · CVE-2009-3014

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 3.0.13 and earlier Mozilla Firefox version 3.5 Mozilla Firefox version 3.6 a1 pre Mozilla Firefox version 3.7 a1 pre SeaMonkey version 1.1.17 Mozilla versions 1.7.x and earlier

Description: The issue allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks. This is possible due to improper handling of javascript: URIs in HTML links within 302 error documents sent from web servers. Attack vectors are related to injecting or specifying the content of a Location HTTP response header.

Recommendations: For Mozilla Firefox versions 3.0.13 and earlier, update to a version later than 3.0.13 to resolve the issue. For Mozilla Firefox version 3.5, update to a version later than 3.5 to resolve the issue. For Mozilla Firefox version 3.6 a1 pre, update to a version later than 3.6 a1 pre to resolve the issue. For Mozilla Firefox version 3.7 a1 pre, update to a version later than 3.7 a1 pre to resolve the issue. For SeaMonkey version 1.1.17, update to a version later than 1.1.17 to resolve the issue. For Mozilla versions 1.7.x and earlier, update to a version later than 1.7.x to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-3014

Produtos afetados

Firefox

Seamonkey

Referências · 5

• 🔥 http://websecurity.com.ua/3386 · Exploit
• 🔥 http://websecurity.com.ua/3373 · Exploit
• http://securityfocus.com/archive/1/506163/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3014 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52995 · Nota