CVE-2009-0354

Published: Feb 4, 2009Modified: Apr 23, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.

Affected (9)

Products: Mozilla: Firefox

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.0 alpha
Mozilla Firefox	Version 3.0 beta2
Mozilla Firefox	Version 3.0 beta5

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (36)

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2009-0256.html

Source: secalert@redhat.com

http://secunia.com/advisories/33799

Source: secalert@redhat.com

http://secunia.com/advisories/33809

Source: secalert@redhat.com

http://secunia.com/advisories/33831

Source: secalert@redhat.com

http://secunia.com/advisories/33841

Source: secalert@redhat.com

http://secunia.com/advisories/33846

Source: secalert@redhat.com

http://secunia.com/advisories/33869

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:044

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2009/mfsa2009-02.html

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/33598

Source: secalert@redhat.com

http://www.securitytracker.com/id?1021664

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-717-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0313

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=468581

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2009-0256.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33799

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33809

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33831

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33841

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33846

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33869

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2009:044

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2009/mfsa2009-02.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/33598

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021664

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/usn-717-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/0313

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=468581

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.