PT-2010-1316 · Mozilla+1 · Firefox+2

Hidetake Jo · Published 2010-02-17 · Updated 2017-09-19 · CVE-2009-3988

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.0.x through 3.0.17 Mozilla Firefox versions 3.5.x through 3.5.7 SeaMonkey versions prior to 2.0.3

Description The issue allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values. This is due to improper restriction of read access to object properties in showModalDialog.

Recommendations For Mozilla Firefox versions 3.0.x through 3.0.17, update to version 3.0.18 or later. For Mozilla Firefox versions 3.5.x through 3.5.7, update to version 3.5.8 or later. For SeaMonkey versions prior to 2.0.3, update to version 2.0.3 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3988

DSA-1999-1

RHSA-2010:0112

RHSA-2010_0112

ZDI-10-019

Affected Products

Firefox

Red Hat

Seamonkey

References · 28

• https://nvd.nist.gov/vuln/detail/CVE-2009-3988 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html · Vendor Advisory
• http://ubuntu.com/usn/USN-896-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0112.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:042 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html · Vendor Advisory
• http://debian.org/security/2010/dsa-1999 · Vendor Advisory
• http://ubuntu.com/usn/USN-895-1 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-10-019 · Security Note
• https://access.redhat.com/security/cve/CVE-2010-0171 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=504862 · Note
• http://vupen.com/english/advisories/2010/0405 · Note