PT-2009-6659 · Mozilla+2 · Libmozjs1D-Dbg+6

Moz_Bug_R_A4 · Published 1970-01-01 · Updated 2021-07-29 · CVE-2009-2472

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.12 libmozjs-dev (affected versions not specified) libmozjs1d (affected versions not specified) libmozjs1d-dbg (affected versions not specified) libmozillainterfaces-java (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libmozjs-dev, libmozjs1d, libmozjs1d-dbg, and libmozillainterfaces-java. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Additionally, Mozilla Firefox before version 3.0.12 is vulnerable to a "cross origin wrapper bypass" that allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document.

Recommendations For Mozilla Firefox versions prior to 3.0.12, update to version 3.0.12 or later to resolve the issue. For libmozjs-dev, libmozjs1d, libmozjs1d-dbg, and libmozillainterfaces-java, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

CWE-399

Related Identifiers

BDU:2015-01736

BDU:2015-01737

BDU:2015-01738

BDU:2015-01739

CVE-2009-2472

DSA-1840-1

RHSA-2009:1162

RHSA-2009_1162

Affected Products

Debian

Firefox

Red Hat

Libmozillainterfaces-Java

Libmozjs-Dev

Libmozjs1D

Libmozjs1D-Dbg

References · 51

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2463 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01739 · Security Note
• https://bdu.fstec.ru/vul/2015-02141 · Security Note
• http://mozilla.org/security/announce/2009/mfsa2009-40.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2469 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2466 · Security Note
• https://bdu.fstec.ru/vul/2015-02140 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01738 · Security Note
• https://bdu.fstec.ru/vul/2015-02139 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=481434 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-July/msg01032.html · Vendor Advisory
• http://securityfocus.com/bid/35758 · Patch