CVE-2009-3007: Medium severity flock vulnerability

Published Aug 28, 2009

Updated

Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker.

Affected Software

3 affected components

Flock Flock=2.5.1

Mozilla SeaMonkey=1.1.7

Mozilla Firefox=3.5.1

Event History

Aug 28, 2009

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-3007?

CVE-2009-3007 has a moderate severity rating due to the possibility of URL spoofing.

How do I fix CVE-2009-3007?

To fix CVE-2009-3007, users should update their Mozilla Firefox to a version higher than 3.5.1, or upgrade SeaMonkey and Flock to non-vulnerable versions.

Which versions are affected by CVE-2009-3007?

CVE-2009-3007 affects Mozilla Firefox 3.5.1, SeaMonkey 1.1.7, and Flock 2.5.1.

What type of attack is associated with CVE-2009-3007?

CVE-2009-3007 is associated with context-dependent attacks that can spoof the address bar using relative URIs.

Can CVE-2009-3007 be exploited remotely?

CVE-2009-3007 requires user interaction to exploit, making it a context-dependent vulnerability.