Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-1840

Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy before loading a script file into a XUL document, which allows remote attackers to bypass intended access restrictions via a crafted HTML document, as demonstrated by a "web bug" in an e-mail message, or web script or an advertisement in a web page.

Published

2009-06-12T21:30:00.420

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

10.0

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	≤ 3.0.10	Yes
Application	mozilla	firefox	3.0	Yes
Application	mozilla	firefox	3.0	Yes
Application	mozilla	firefox	3.0	Yes
Application	mozilla	firefox	3.0	Yes
Application	mozilla	firefox	3.0.1	Yes
Application	mozilla	firefox	3.0.2	Yes
Application	mozilla	firefox	3.0.3	Yes
Application	mozilla	firefox	3.0.4	Yes
Application	mozilla	firefox	3.0.5	Yes
Application	mozilla	firefox	3.0.6	Yes
Application	mozilla	firefox	3.0.7	Yes
Application	mozilla	firefox	3.0.8	Yes
Application	mozilla	firefox	3.0.9	Yes
Application	mozilla	firefox	3.0beta5	Yes
Application	mozilla	firefox	3.1	Yes
Application	mozilla	seamonkey	*	Yes
Application	mozilla	thunderbird	*	Yes

References

http://osvdb.org/55158 ([email protected])
http://secunia.com/advisories/35331 Vendor Advisory ([email protected])
http://secunia.com/advisories/35415 ([email protected])
http://secunia.com/advisories/35431 Vendor Advisory ([email protected])
http://secunia.com/advisories/35439 Vendor Advisory ([email protected])
http://secunia.com/advisories/35440 Vendor Advisory ([email protected])
http://secunia.com/advisories/35468 ([email protected])
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468 ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 ([email protected])
http://www.debian.org/security/2009/dsa-1820 ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2009:141 ([email protected])
http://www.mozilla.org/security/announce/2009/mfsa2009-31.html Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/35326 Patch ([email protected])
http://www.securitytracker.com/id?1022379 ([email protected])
http://www.vupen.com/english/advisories/2009/1572 Patch, Vendor Advisory ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=477979 ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=503582 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/51076 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9448 ([email protected])
https://rhn.redhat.com/errata/RHSA-2009-1095.html ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html ([email protected])
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html ([email protected])
http://osvdb.org/55158 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35331 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35415 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35431 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35439 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35440 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/35468 (af854a3a-2127-422b-91ae-364da2661108)
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468 (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2009/dsa-1820 (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2009:141 (af854a3a-2127-422b-91ae-364da2661108)
http://www.mozilla.org/security/announce/2009/mfsa2009-31.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/35326 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1022379 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2009/1572 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.mozilla.org/show_bug.cgi?id=477979 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=503582 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/51076 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9448 (af854a3a-2127-422b-91ae-364da2661108)
https://rhn.redhat.com/errata/RHSA-2009-1095.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html (af854a3a-2127-422b-91ae-364da2661108)