CVE-2009-1840
First published: Mon Jun 01 2009(Updated: )
Mozilla add-on developer and community member Wladimir Palant reported that two key security checks are not being called when loading XUL scripts. The checks which are skipped are intended to verify that content loading policies will not be violated by loading a XUL script. Mozilla code relying on the content policies for security, such as privileged add-ons, could potentially be exploited to run JavaScript with elevated privileges.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla SeaMonkey | ||
| Mozilla Firefox | =3.0.7 | |
| Mozilla Firefox | =3.1-beta1 | |
| Mozilla Firefox | =3.0.9 | |
| Mozilla Firefox | =3.0.8 | |
| Mozilla Firefox | =3.0.4 | |
| Mozilla Firefox | =3.0.5 | |
| Mozilla Firefox | =3.0-beta2 | |
| Mozilla Thunderbird | ||
| Mozilla Firefox | =3.0.3 | |
| Mozilla Firefox | <=3.0.10 | |
| Mozilla Firefox | =3.0.6 | |
| Mozilla Firefox | =3.0 | |
| Mozilla Firefox | =3.0.1 | |
| Mozilla Firefox | =3.0.2 | |
| Mozilla Firefox | =3.0beta5 | |
| Mozilla Firefox | =3.0-beta5 | |
| Mozilla Firefox | =3.0-alpha |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://rhn.redhat.com/errata/RHSA-2009-1095.html
- https://bugzilla.redhat.com/show_bug.cgi?id=503582
- http://secunia.com/advisories/35439
- http://www.vupen.com/english/advisories/2009/1572
- http://secunia.com/advisories/35440
- https://bugzilla.mozilla.org/show_bug.cgi?id=477979
- http://secunia.com/advisories/35431
- http://secunia.com/advisories/35331
- http://www.mozilla.org/security/announce/2009/mfsa2009-31.html
- http://www.securityfocus.com/bid/35326
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html
- http://www.securitytracker.com/id?1022379
- http://osvdb.org/55158
- http://www.debian.org/security/2009/dsa-1820
- http://secunia.com/advisories/35468
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:141
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468
- http://secunia.com/advisories/35415
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51076
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9448
- collector/redhat-bugzilla
- alias/CVE-2009-1840
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/last-modified-date
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/mozilla
- canonical/mozilla seamonkey
- canonical/mozilla firefox
- version/mozilla firefox/3.0.7
- version/mozilla firefox/3.1-beta1
- version/mozilla firefox/3.0.9
- version/mozilla firefox/3.0.8
- version/mozilla firefox/3.0.4
- version/mozilla firefox/3.0.5
- version/mozilla firefox/3.0-beta2
- canonical/mozilla thunderbird
- version/mozilla firefox/3.0.3
- version/mozilla firefox/3.0.10
- version/mozilla firefox/3.0.6
- version/mozilla firefox/3.0
- version/mozilla firefox/3.0.1
- version/mozilla firefox/3.0.2
- version/mozilla firefox/3.0beta5
- version/mozilla firefox/3.0-beta5
- version/mozilla firefox/3.0-alpha