PT-2009-3841 · Mozilla+1 · Firefox+3

Moz_Bug_R_A4 · Published 2009-04-21 · Updated 2024-12-12 · CVE-2009-1309

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.9 Thunderbird (affected versions not specified) SeaMonkey (affected versions not specified)

Description The issue is related to the improper implementation of the Same Origin Policy, which can lead to cross-site scripting (XSS) attacks. This is due to two main problems:

1. A mismatch for a document's principal in XMLHttpRequest, and
2. An incorrect proto scope in XPCNativeWrapper.toString. This allows remote attackers to conduct attacks via a crafted document.

Recommendations For Mozilla Firefox versions prior to 3.0.9, update to version 3.0.9 or later. For Thunderbird, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For SeaMonkey, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-1309

DSA-1797-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2009:0436

RHSA-2009:0437

RHSA-2009:1125

RHSA-2009:1126

RHSA-2009_0436

RHSA-2009_0437

RHSA-2009_1125

RHSA-2009_1126

Affected Products

Firefox

Red Hat

Seamonkey

Thunderbird

References · 2139

• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:141 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1308 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• http://mozilla.org/security/announce/2009/mfsa2009-19.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1309 · Security Note
• http://ubuntu.com/usn/usn-782-1 · Vendor Advisory
• https://usn.ubuntu.com/764-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2009-0437.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-April/msg00683.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1125.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1797 · Vendor Advisory