CVE-2009-3985: Medium severity mozilla seamonkey vulnerability
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654.
Other sources
Security researcher Jordi Chancel reported an issue similar to one fixed in mfsa2009-44 in which a web page can set document.location to a URL that can't be displayed properly and then inject content into the resulting blank page. An attacker could use this vulnerability to place a legitimate-looking but invalid URL in the location bar and inject HTML and JavaScript into the body of the page, resulting in a spoofing attack.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3985?
CVE-2009-3985 is classified as a moderate severity vulnerability.
How do I fix CVE-2009-3985?
To mitigate CVE-2009-3985, upgrade to Mozilla Firefox version 3.0.16 or later, or SeaMonkey version 2.0.1 or later.
Which versions of Firefox are affected by CVE-2009-3985?
CVE-2009-3985 affects Firefox versions prior to 3.0.16 and 3.5.x before 3.5.6.
Which versions of SeaMonkey are impacted by CVE-2009-3985?
SeaMonkey versions prior to 2.0.1 are affected by CVE-2009-3985.
What type of vulnerability is CVE-2009-3985?
CVE-2009-3985 is a vulnerability that allows remote attackers to spoof content associated with an invalid URL.