PT-2009-3843 · Mozilla+1 · Firefox+2

Paolo Amadini · Published 2009-04-21 · Updated 2024-12-12 · CVE-2009-1311

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.9 SeaMonkey versions prior to 1.1.17

Description The issue allows user-assisted remote attackers to obtain sensitive information via a web page with an embedded frame. This occurs when the inner frame's URL receives POST data from an outer page during a SAVEMODE FILEONLY save of the inner frame.

Recommendations For Mozilla Firefox versions prior to 3.0.9, update to version 3.0.9 or later to resolve the issue. For SeaMonkey versions prior to 1.1.17, update to version 1.1.17 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-1311

DSA-1797-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2009:0436

RHSA-2009:0437

RHSA-2009_0436

RHSA-2009_0437

Affected Products

Firefox

Red Hat

Seamonkey

References · 2111

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=471962 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-July/msg00504.html · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1308 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:111 · Vendor Advisory
• http://mozilla.org/security/announce/2009/mfsa2009-21.html · Vendor Advisory
• https://usn.ubuntu.com/764-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-July/msg00444.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2009-0437.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-April/msg00683.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1797 · Vendor Advisory