PT-2009-6659 · Mozilla+2 · Libmozjs1D-Dbg+6

Moz_Bug_R_A4 · Publicado 1970-01-01 · Atualizado 2021-07-29 · CVE-2009-2472

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.12 libmozjs-dev (affected versions not specified) libmozjs1d (affected versions not specified) libmozjs1d-dbg (affected versions not specified) libmozillainterfaces-java (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libmozjs-dev, libmozjs1d, libmozjs1d-dbg, and libmozillainterfaces-java. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Additionally, Mozilla Firefox before version 3.0.12 is vulnerable to a "cross origin wrapper bypass" that allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document.

Recommendations For Mozilla Firefox versions prior to 3.0.12, update to version 3.0.12 or later to resolve the issue. For libmozjs-dev, libmozjs1d, libmozjs1d-dbg, and libmozillainterfaces-java, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

CWE-399

Identificadores relacionados

BDU:2015-01736

BDU:2015-01737

BDU:2015-01738

BDU:2015-01739

CVE-2009-2472

DSA-1840-1

RHSA-2009:1162

RHSA-2009_1162

Produtos afetados

Debian

Firefox

Red Hat

Libmozillainterfaces-Java

Libmozjs-Dev

Libmozjs1D

Libmozjs1D-Dbg

Referências · 51

• https://access.redhat.com/security/cve/CVE-2009-2464 · Nota
• https://access.redhat.com/security/cve/CVE-2009-2470 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2463 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2009-2465 · Nota
• http://secunia.com/advisories/36145 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-01739 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9497 · Nota
• https://bdu.fstec.ru/vul/2015-02141 · Nota de Segurança
• http://mozilla.org/security/announce/2009/mfsa2009-40.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2469 · Nota de Segurança
• https://bugzilla.mozilla.org/show_bug.cgi?id=465980 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2466 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2009-2469 · Nota
• https://bdu.fstec.ru/vul/2015-02140 · Nota de Segurança