PT-2009-3844 · Mozilla+1 · Firefox+2

Mustlive · Published 2009-04-21 · Updated 2024-12-12 · CVE-2009-1312

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.9 SeaMonkey version 1.1.17 Mozilla Firefox version 3.6 a1 pre Mozilla versions 1.7.x and earlier

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to injecting a Refresh header or specifying the content of a Refresh header in HTTP responses, due to the failure to block javascript: URIs in Refresh headers.

Recommendations For Mozilla Firefox versions prior to 3.0.9, update to version 3.0.9 or later. For SeaMonkey version 1.1.17, update to a version later than 1.1.17. For Mozilla Firefox version 3.6 a1 pre, update to a version later than 3.6 a1 pre. For Mozilla versions 1.7.x and earlier, update to a version later than 1.7.x.

Exploit

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-1312

DSA-1797-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2009:0436

RHSA-2009:0437

RHSA-2009_0436

RHSA-2009_0437

Affected Products

Firefox

Red Hat

Seamonkey

References · 2111

• 🔥 https://exploit-db.com/exploits/32942 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=475636 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1308 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:111 · Vendor Advisory
• https://usn.ubuntu.com/764-1 · Vendor Advisory
• http://mozilla.org/security/announce/2009/mfsa2009-22.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2009-0437.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-April/msg00683.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1312 · Security Note
• http://redhat.com/support/errata/RHSA-2009-0436.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2009-0354 · Note