PT-2009-5060 · Mozilla · Firefox

Wladimir Palant · Published 2009-08-04 · Updated 2009-09-04 · CVE-2009-2665

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.5.x through 3.5.1

Description The issue arises from the nsDocument::SetScriptGlobalObject function in Mozilla Firefox, which does not properly handle a Link HTTP header when certain add-ons are enabled. This allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted web page, due to an incorrect security wrapper.

Recommendations For Mozilla Firefox versions 3.5.x through 3.5.1, update to version 3.5.2 or later to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-2665

Affected Products

Firefox

References · 9

• http://mozilla.org/security/announce/2009/mfsa2009-46.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/2142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2665 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00261.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-August/msg00198.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=498897 · Note
• http://securityfocus.com/bid/35928 · Note
• http://secunia.com/advisories/36126 · Note