CVE-2009-1841: Code Injection
Published Jun 1, 2009
·Updated
js/src/xpconnect/src/xpcwrappedjsclass.cpp in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to execute arbitrary web script with the privileges of a chrome object, as demonstrated by the browser sidebar and the FeedWriter.
Other sources
Mozilla security researcher mozbugra4 reported a series of vulnerabilities which allow scripts from page content to run with elevated privileges. Using these vulnerabilities, an attacker could cause a chrome privileged object, such as the browser sidebar or the FeedWriter, to interact with web content in such a way that attacker controlled code may be executed with the object's chrome privileges.
Affected Software
202 affected components
Mozilla SeaMonkey=1.1.10
Mozilla Firefox=0.1
Mozilla Thunderbird=1.5.0.7
Mozilla Firefox=0.9_rc
Mozilla Thunderbird=0.6
Mozilla SeaMonkey=1.0.3
Mozilla Firefox=0.8
Mozilla Firefox=2.0.0.12
Mozilla Thunderbird=0.7.2
Mozilla Firefox=1.5-beta2
Mozilla Firefox=2.0_.7
Mozilla Thunderbird=2.0.0.4
Mozilla SeaMonkey=1.1.8
Mozilla SeaMonkey<=1.1.16
Mozilla Firefox=3.0.7
Mozilla Firefox=1.5.2
Mozilla SeaMonkey=1.0.1
Mozilla SeaMonkey=1.1.7
Mozilla Thunderbird=2.0.0.6
Mozilla Firefox=3.0.9
Mozilla SeaMonkey=1.0.6
Mozilla Firefox=1.5.0.6
Mozilla Firefox=1.8
Mozilla SeaMonkey=1.0.9
Mozilla Thunderbird=0.3
Mozilla SeaMonkey=1.1.3
Mozilla Firefox=2.0.0.2
Mozilla Firefox=1.5.0.10
Mozilla Firefox=1.5.0.3
Mozilla Thunderbird=0.2
Mozilla SeaMonkey=1.0
Mozilla Firefox=3.0.8
Mozilla Thunderbird=2.0_.5
Mozilla Thunderbird=1.0.7
Mozilla Firefox=1.5.0.11
Mozilla Thunderbird=2.0.0.18
Mozilla Firefox=1.4.1
Mozilla SeaMonkey=1.0.99
Mozilla Thunderbird=2.0.0.9
Mozilla Firefox=1.5.4
Mozilla SeaMonkey=1.1.5
Mozilla Firefox=1.0.2
Mozilla SeaMonkey=1.0-beta
Mozilla Thunderbird=2.0_.12
Mozilla Thunderbird=2.0.0.15
Mozilla Firefox=3.0.4
Mozilla Firefox=1.5-beta1
Mozilla SeaMonkey=1.1-alpha
Mozilla Thunderbird=2.0.0.16
Mozilla Firefox=2.0_8
Mozilla Thunderbird=2.0.0.8
Mozilla Thunderbird=2.0.0.7
Mozilla Firefox=2.0_.9
Mozilla Firefox=3.0.5
Mozilla SeaMonkey=1.0-alpha
Mozilla Thunderbird=1.7.1
Mozilla Thunderbird=2.0_8
Mozilla Firefox=1.5
Mozilla Thunderbird=1.5.0.3
Mozilla Firefox=0.9.1
Mozilla Thunderbird=1.5.0.10
Mozilla Thunderbird=1.5.0.5
Mozilla Firefox=1.0.4
Mozilla Firefox=2.0.0.7
Mozilla Firefox=1.0.7
Mozilla Thunderbird=1.5.0.6
Mozilla SeaMonkey=1.1.12
Mozilla SeaMonkey=1.1
Mozilla Firefox=2.0.0.9
Mozilla Firefox=0.10.1
Mozilla Firefox=2.0_.1
Mozilla Thunderbird=1.0
Mozilla Thunderbird=2.0.0.3
Mozilla Firefox=0.9
Mozilla Thunderbird=1.0.1
Mozilla Firefox=2.0.0.16
Mozilla Thunderbird=1.5-beta2
Mozilla Firefox=3.0-beta2
Mozilla Firefox=1.5.6
Mozilla Thunderbird=2.0.0.2
Mozilla Firefox=2.0.0.17
Mozilla Firefox=0.7
Mozilla Firefox=2.0.0.15
Mozilla SeaMonkey=1.0
Mozilla Firefox=0.2
Mozilla SeaMonkey=1.0.8
Mozilla Thunderbird=1.0.2
Mozilla Firefox=0.3
Mozilla Thunderbird=2.0.0.0
Mozilla Thunderbird=1.5.0.13
Mozilla SeaMonkey=1.1.11
Mozilla Firefox=2.0_.10
Mozilla Firefox=1.0
Mozilla Firefox=3.0.3
Mozilla SeaMonkey=1.1-beta
Mozilla SeaMonkey=1.1.1
Mozilla Firefox=1.5.0.7
Mozilla Thunderbird=2.0.0.12
Mozilla Firefox=2.0
Mozilla Thunderbird=1.5
Mozilla Firefox=1.0.1
Mozilla Thunderbird=1.5.0.2
Mozilla SeaMonkey=1.1.5-1.1.10
Mozilla Firefox=2.0-beta1
Mozilla Firefox=2.0.0.14
Mozilla Firefox=0.6
Mozilla Thunderbird=2.0.0.13
Mozilla Firefox<=3.0.10
Mozilla Firefox=0.7.1
Mozilla SeaMonkey=1.1.15
Mozilla Thunderbird=2.0_.9
Mozilla Firefox=3.0.6
Mozilla Thunderbird=1.5.0.8
Mozilla Thunderbird=2.0.0.14
Mozilla Firefox=1.5.0.8
Mozilla Firefox=2.0_.5
Mozilla Firefox=1.0.6
Mozilla Thunderbird=0.5
Mozilla Thunderbird=1.0.4
Mozilla Firefox=2.0.0.3
Mozilla Thunderbird=1.5.2
Mozilla Firefox=1.5.0.9
Mozilla Thunderbird=2.0.0.17
Mozilla Firefox=1.5.0.5
Mozilla Firefox=1.5.7
Mozilla Firefox=1.5.0.12
Mozilla Thunderbird<=2.0.0.19
Mozilla Thunderbird=1.5.0.9
Mozilla Thunderbird=1.5.0.11
Mozilla Thunderbird=0.9
Mozilla Thunderbird=1.0.3
Mozilla Firefox=2.0.0.6
Mozilla SeaMonkey=1.1.6
Mozilla Thunderbird=2.0.0.11
Mozilla Thunderbird=1.5.0.12
Mozilla Thunderbird=2.0_.13
Mozilla Firefox=3.0
Mozilla Firefox=2.0.0.11
Mozilla Firefox=1.5.0.2
Mozilla Firefox=1.0.3
Mozilla Firefox=3.0.1
Mozilla Firefox=2.0.0.4
Mozilla Firefox=0.5
Mozilla Firefox=0.6.1
Mozilla Firefox=1.5.1
Mozilla Thunderbird=2.0_.14
Mozilla Thunderbird=0.7.3
Mozilla Firefox=2.0.0.21
Mozilla Firefox=0.9.3
Mozilla SeaMonkey=1.0
Mozilla Firefox=2.0.0.13
Mozilla Firefox=2.0.0.18
Mozilla Thunderbird=0.4
Mozilla SeaMonkey=1.0
Mozilla Thunderbird=1.5.1
Mozilla Thunderbird=0.7
Mozilla Thunderbird=1.5.0.14
Mozilla Firefox=2.0-rc2
Mozilla Firefox=2.0.0.1
Mozilla Thunderbird=1.0.6
Mozilla Firefox=3.0.2
Mozilla Thunderbird=1.0.5-beta
Mozilla Firefox=2.0_.6
Mozilla Firefox=2.0_.4
Mozilla Thunderbird=2.0.0.5
Mozilla Thunderbird=1.7.3
Mozilla SeaMonkey=1.0.4
Mozilla Firefox=1.5.5
Mozilla Firefox=0.9.2
Mozilla Firefox=1.0-preview_release
Mozilla Thunderbird=2.0.0.1
Mozilla Firefox=2.0-beta_1
Mozilla SeaMonkey=1.1.9
Mozilla SeaMonkey=1.1.13
Mozilla Firefox=3.0beta5
Mozilla Firefox=2.0.0.20
Mozilla Thunderbird=1.5.0.1
Mozilla Firefox=2.0.0.8
Mozilla Thunderbird=2.0_.4
Mozilla Thunderbird=1.0.8
Mozilla Thunderbird=0.1
Mozilla Firefox=3.0-beta5
Mozilla Firefox=0.9-rc
Mozilla Firefox=2.0.0.19
Mozilla Firefox=1.5.8
Mozilla Firefox=1.5.3
Mozilla Firefox=0.4
Mozilla Thunderbird=0.7.1
Mozilla Thunderbird=1.0.5
Mozilla Thunderbird=0.8
Mozilla Firefox=1.5.0.4
Mozilla Firefox=1.5.0.1
Mozilla Firefox=0.10
Mozilla Thunderbird=2.0_.6
Mozilla Firefox=1.0.5
Mozilla Firefox=2.0.0.5
Mozilla Firefox=2.0.0.10
Mozilla Firefox=2.0-rc3
Mozilla Firefox=3.0-alpha
Mozilla Firefox=1.0.6
Mozilla Thunderbird=1.5.0.4
Mozilla Firefox=1.0.8
Remediation
Patch Available
Event History
Jun 1, 2009
Data Sourced
07:20 PM
DescriptionSeverityAffected Software
Jun 12, 2009
CVE Published
via MITRE·09:07 PM
Data Sourced
via MITRE·09:07 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-1841?
CVE-2009-1841 is classified as a high severity vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2009-1841?
To mitigate CVE-2009-1841, update to the latest versions of Mozilla Firefox, Thunderbird, or SeaMonkey that are unaffected by this vulnerability.
3
What versions are affected by CVE-2009-1841?
CVE-2009-1841 affects Mozilla Firefox versions earlier than 3.0.11, Thunderbird versions earlier than 2.0.0.22, and SeaMonkey versions earlier than 1.1.17.
4
Can CVE-2009-1841 allow attackers to execute arbitrary code?
Yes, CVE-2009-1841 allows remote attackers to execute arbitrary web script with the privileges of a chrome object.
5
Is there a workaround for CVE-2009-1841 until I can update?
Disabling script execution in your browser settings may act as a temporary workaround for CVE-2009-1841.