CVE-2009-0776

Published: Mar 5, 2009Modified: Apr 23, 2026

7.1

Vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Exploitability: 8.6 / Impact: 6.9

Source: NVD

Description

nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect.

Affected (88)

Products: Mozilla: Firefox, Seamonkey, Thunderbird

3 products

Configuration A

88 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.0.6
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.17
Mozilla Firefox	Version 2.0.0.18
Mozilla Firefox	Version 2.0.0.19
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.20
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0
Mozilla Seamonkey	Up to 1.1.14
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta
Mozilla Thunderbird	Up to 2.0.0.20
Mozilla Thunderbird	Version 2.0.0.0
Mozilla Thunderbird	Version 2.0.0.12
Mozilla Thunderbird	Version 2.0.0.14
Mozilla Thunderbird	Version 2.0.0.16
Mozilla Thunderbird	Version 2.0.0.17
Mozilla Thunderbird	Version 2.0.0.18
Mozilla Thunderbird	Version 2.0.0.19
Mozilla Thunderbird	Version 2.0.0.4
Mozilla Thunderbird	Version 2.0.0.5
Mozilla Thunderbird	Version 2.0.0.6
Mozilla Thunderbird	Version 2.0.0.9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (76)

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html

Source: secalert@redhat.com

http://secunia.com/advisories/34137

Source: secalert@redhat.com

http://secunia.com/advisories/34140

Source: secalert@redhat.com

http://secunia.com/advisories/34145

Source: secalert@redhat.com

http://secunia.com/advisories/34272

Source: secalert@redhat.com

http://secunia.com/advisories/34324

Source: secalert@redhat.com

http://secunia.com/advisories/34383

Source: secalert@redhat.com

http://secunia.com/advisories/34387

Source: secalert@redhat.com

http://secunia.com/advisories/34417

Source: secalert@redhat.com

http://secunia.com/advisories/34462

Source: secalert@redhat.com

http://secunia.com/advisories/34464

Source: secalert@redhat.com

http://secunia.com/advisories/34527

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.433952

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm

Source: secalert@redhat.com

http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1751

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1830

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:075

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:083

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2009/mfsa2009-09.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2009-0258.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-0315.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-0325.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/33990

Source: secalert@redhat.com

http://www.securitytracker.com/id?1021797

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0632

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=414540

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5956

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6017

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6191

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7390

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9241

Source: secalert@redhat.com

https://usn.ubuntu.com/741-1/

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00769.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00771.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html