CVE-2009-1308

Published: Apr 22, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, as exploited in the wild by a March 2009 eBay listing.

Affected (102)

Products: Mozilla: Firefox, Seamonkey, Thunderbird

3 products

Configuration A

102 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.0.8
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.1
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.3
Mozilla Firefox	Version 0.4
Mozilla Firefox	Version 0.5
Mozilla Firefox	Version 0.6.1
Mozilla Firefox	Version 0.6
Mozilla Firefox	Version 0.7.1
Mozilla Firefox	Version 0.7
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 0.9_rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.0 preview_release
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 1.8
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.17
Mozilla Firefox	Version 2.0.0.18
Mozilla Firefox	Version 2.0.0.19
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.20
Mozilla Firefox	Version 2.0.0.21
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta1
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3
Mozilla Firefox	Version 2.0_.10
Mozilla Firefox	Version 2.0_.1
Mozilla Firefox	Version 2.0_.4
Mozilla Firefox	Version 2.0_.5
Mozilla Firefox	Version 2.0_.6
Mozilla Firefox	Version 2.0_.7
Mozilla Firefox	Version 2.0_.9
Mozilla Firefox	Version 2.0_8
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0.6
Mozilla Firefox	Version 3.0.7
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.0 alpha
Mozilla Firefox	Version 3.0 beta2
Mozilla Firefox	Version 3.0 beta5
Mozilla Firefox	Version 3.0beta5
Mozilla Seamonkey	All versions
Mozilla Thunderbird	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (56)

http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html

Source: secalert@redhat.com

http://secunia.com/advisories/34758

Source: secalert@redhat.com

http://secunia.com/advisories/34780

Source: secalert@redhat.com

http://secunia.com/advisories/34843

Source: secalert@redhat.com

http://secunia.com/advisories/34894

Source: secalert@redhat.com

http://secunia.com/advisories/35042

Source: secalert@redhat.com

http://secunia.com/advisories/35065

Source: secalert@redhat.com

http://secunia.com/advisories/35536

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1797

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:111

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:141

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2009/mfsa2009-18.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2009-0436.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-1126.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/34656

Source: secalert@redhat.com

http://www.securitytracker.com/id?1022097

Source: secalert@redhat.com

http://www.theregister.co.uk/2009/03/08/ebay_scam_wizardy/

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-782-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/1125

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=481558

Source: secalert@redhat.com

Exploit

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10428

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6173

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6185

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6296

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7285

Source: secalert@redhat.com

https://usn.ubuntu.com/764-1/

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html