CVE-2009-3988

Published: Feb 22, 2010Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.

Affected (33)

Products: Mozilla: Firefox, Seamonkey

2 products

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.0.17
Mozilla Firefox	Version 3.0.10
Mozilla Firefox	Version 3.0.11
Mozilla Firefox	Version 3.0.12
Mozilla Firefox	Version 3.0.13
Mozilla Firefox	Version 3.0.14
Mozilla Firefox	Version 3.0.15
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0.6
Mozilla Firefox	Version 3.0.7
Mozilla Firefox	Version 3.0.8
Mozilla Firefox	Version 3.0.9
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.5.1
Mozilla Firefox	Version 3.5.2
Mozilla Firefox	Version 3.5.3
Mozilla Firefox	Version 3.5.4
Mozilla Firefox	Version 3.5.5
Mozilla Firefox	Version 3.5.6
Mozilla Firefox	Version 3.5.7
Mozilla Firefox	Version 3.5
Mozilla Seamonkey	Version 2.0
Mozilla Seamonkey	Version 2.0 alpha_1
Mozilla Seamonkey	Version 2.0 alpha_2
Mozilla Seamonkey	Version 2.0 alpha_3
Mozilla Seamonkey	Version 2.0 beta_1
Mozilla Seamonkey	Version 2.0 beta_2
Mozilla Seamonkey	Version 2.0 rc1
Mozilla Seamonkey	Version 2.0 rc2

Related CWEs

References (34)

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html

Source: cve@mitre.org

http://secunia.com/advisories/37242

Source: cve@mitre.org

http://secunia.com/advisories/38847

Source: cve@mitre.org

http://www.debian.org/security/2010/dsa-1999

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2010:042

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2010/mfsa2010-04.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2010-0112.html

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-895-1

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-896-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/0405

Source: cve@mitre.org

https://bugzilla.mozilla.org/show_bug.cgi?id=504862

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/56362

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37242

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/38847

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2010/dsa-1999

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2010:042

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2010/mfsa2010-04.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2010-0112.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-895-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-896-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/0405

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=504862

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/56362

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.