Vulnerability-Lookup

CVE-2009-0354 (GCVE-0-2009-0354)

Vulnerability from cvelistv5 – Published: 2009-02-04 19:00 – Updated: 2024-08-07 04:31

Summary

Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

18 references

URL	Tags
http://www.vupen.com/english/advisories/2009/0313	vdb-entryx_refsource_VUPEN
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/33809	third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://rhn.redhat.com/errata/RHSA-2009-0256.html	vendor-advisoryx_refsource_REDHAT
http://www.mozilla.org/security/announce/2009/mfs…	x_refsource_CONFIRM
http://support.avaya.com/elmodocs2/security/ASA-2…	x_refsource_CONFIRM
http://secunia.com/advisories/33831	third-party-advisoryx_refsource_SECUNIA
https://bugzilla.mozilla.org/show_bug.cgi?id=468581	x_refsource_CONFIRM
http://secunia.com/advisories/33841	third-party-advisoryx_refsource_SECUNIA
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://secunia.com/advisories/33846	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33799	third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/33598	vdb-entryx_refsource_BID
https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
http://secunia.com/advisories/33869	third-party-advisoryx_refsource_SECUNIA
http://www.securitytracker.com/id?1021664	vdb-entryx_refsource_SECTRACK
http://www.ubuntu.com/usn/usn-717-1	vendor-advisoryx_refsource_UBUNTU

Date Public

2009-02-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:31:25.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2009-0313",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0313"
          },
          {
            "name": "SUSE-SA:2009:009",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
          },
          {
            "name": "33809",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33809"
          },
          {
            "name": "MDVSA-2009:044",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
          },
          {
            "name": "RHSA-2009:0256",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
          },
          {
            "name": "33831",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
          },
          {
            "name": "33841",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33841"
          },
          {
            "name": "oval:org.mitre.oval:def:9796",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
          },
          {
            "name": "33846",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33846"
          },
          {
            "name": "33799",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33799"
          },
          {
            "name": "33598",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33598"
          },
          {
            "name": "FEDORA-2009-1399",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
          },
          {
            "name": "33869",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33869"
          },
          {
            "name": "1021664",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021664"
          },
          {
            "name": "USN-717-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-717-1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-02-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "ADV-2009-0313",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0313"
        },
        {
          "name": "SUSE-SA:2009:009",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
        },
        {
          "name": "33809",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33809"
        },
        {
          "name": "MDVSA-2009:044",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
        },
        {
          "name": "RHSA-2009:0256",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
        },
        {
          "name": "33831",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
        },
        {
          "name": "33841",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33841"
        },
        {
          "name": "oval:org.mitre.oval:def:9796",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
        },
        {
          "name": "33846",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33846"
        },
        {
          "name": "33799",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33799"
        },
        {
          "name": "33598",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33598"
        },
        {
          "name": "FEDORA-2009-1399",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
        },
        {
          "name": "33869",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33869"
        },
        {
          "name": "1021664",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021664"
        },
        {
          "name": "USN-717-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-717-1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-0354",
    "datePublished": "2009-02-04T19:00:00.000Z",
    "dateReserved": "2009-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-07T04:31:25.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2009-0354",
      "date": "2026-09-18",
      "epss": "0.02323",
      "percentile": "0.82699"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "412DF091-7604-4110-87A0-3488116A97E5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*",
                  "matchCriteriaId": "7A1DE6AC-C6AA-4B27-AC21-3293E5357A7E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*",
                  "matchCriteriaId": "13AAF607-AEEE-4FAF-BE63-73B1D951EF52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
                  "matchCriteriaId": "20139741-10B1-4E4B-8D5F-A715042049C4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "63DF3D65-C992-44CF-89B4-893526C6242E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A9024117-2E8B-4240-9E21-CC501F3879B5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function."
        },
        {
          "lang": "es",
          "value": "Vulnerabilidad de dominio cruzado en js/src/jsobj.cpp en Mozilla Firefox v3.x anterior a v3.0.6 permite a atacantes remotos evitar la Pol\u00edtica de Mismo Origen (Same Origin Policy) , acceder a las propiedades de cualquier ventana de su elecci\u00f3n y llevar a cabo ataques de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) a trav\u00e9s de vectores que involucran al m\u00e9todo Chrome XBL y a la funci\u00f3n window.eval."
        }
      ],
      "id": "CVE-2009-0354",
      "lastModified": "2024-11-21T00:59:42.557",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "LOW",
            "cvssData": {
              "accessComplexity": "HIGH",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 2.6,
              "confidentialityImpact": "NONE",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 4.9,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ]
      },
      "published": "2009-02-04T19:30:00.420",
      "references": [
        {
          "source": "secalert@redhat.com",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://secunia.com/advisories/33799"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://secunia.com/advisories/33809"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://secunia.com/advisories/33831"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://secunia.com/advisories/33841"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://secunia.com/advisories/33846"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://secunia.com/advisories/33869"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.securityfocus.com/bid/33598"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.securitytracker.com/id?1021664"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.ubuntu.com/usn/usn-717-1"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.vupen.com/english/advisories/2009/0313"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://secunia.com/advisories/33799"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://secunia.com/advisories/33809"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://secunia.com/advisories/33831"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://secunia.com/advisories/33841"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://secunia.com/advisories/33846"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://secunia.com/advisories/33869"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securityfocus.com/bid/33598"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securitytracker.com/id?1021664"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.ubuntu.com/usn/usn-717-1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.vupen.com/english/advisories/2009/0313"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "412DF091-7604-4110-87A0-3488116A97E5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*",
                    "matchCriteriaId": "7A1DE6AC-C6AA-4B27-AC21-3293E5357A7E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*",
                    "matchCriteriaId": "13AAF607-AEEE-4FAF-BE63-73B1D951EF52",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
                    "matchCriteriaId": "20139741-10B1-4E4B-8D5F-A715042049C4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "63DF3D65-C992-44CF-89B4-893526C6242E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A9024117-2E8B-4240-9E21-CC501F3879B5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de dominio cruzado en js/src/jsobj.cpp en Mozilla Firefox v3.x anterior a v3.0.6 permite a atacantes remotos evitar la Pol\u00edtica de Mismo Origen (Same Origin Policy) , acceder a las propiedades de cualquier ventana de su elecci\u00f3n y llevar a cabo ataques de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) a trav\u00e9s de vectores que involucran al m\u00e9todo Chrome XBL y a la funci\u00f3n window.eval."
          }
        ],
        "id": "CVE-2009-0354",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "LOW",
              "cvssData": {
                "accessComplexity": "HIGH",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 2.6,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 4.9,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2009-02-04T19:30:00.420",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://secunia.com/advisories/33799"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://secunia.com/advisories/33809"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://secunia.com/advisories/33831"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://secunia.com/advisories/33841"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://secunia.com/advisories/33846"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://secunia.com/advisories/33869"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.securityfocus.com/bid/33598"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.securitytracker.com/id?1021664"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.ubuntu.com/usn/usn-717-1"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.vupen.com/english/advisories/2009/0313"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/33799"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/33809"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/33831"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/33841"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/33846"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/33869"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/33598"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securitytracker.com/id?1021664"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/usn-717-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2009/0313"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:13:10+00:00",
      "cve": "CVE-2009-0354",
      "id": "CVE-2009-0354",
      "initial_release_date": "2009-02-03T00:00:00+00:00",
      "product_status:fixed": "369",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Firefox XSS using a chrome XBL method and window.eval",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2009/cve-2009-0354.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-02T13:07:49Z",
      "cve": "CVE-2009-0354",
      "id": "CVE-2009-0354",
      "initial_release_date": "2023-02-15T06:05:20Z",
      "product_status:known_affected": "1",
      "product_status:recommended": "38",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2009-0354",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2009-0354.json",
      "version": "17"
    }
  }
}

CERTA-2009-AVI-048

Vulnerability from certfr_avis - Published: - Updated:

Plusieurs vulnérabilités affectent Mozilla Firefox et permettent à une personne malintentionnée de réaliser un grand nombre d'actions malveillantes dont exécuter du code arbitraire à distance.

Description

Plusieurs vulnérabilités ont été découvertes dans Mozilla Firefox :

plusieurs erreurs dans la gestion de la mémoire permettent de réaliser un déni de service ou une exécution de code arbitraire à distance ;
une vulnérabilité affectant une méthode chrome XLB permet d'exécuter du code JavaScript malveillant ;
une erreur dans le système de restauration des sessions permet à une personne malintentionnée de récupérer des données dans un fichier stocké en local lors de la réouverture des onglets sauvegardés ;
un contournement de la vulnérabilité corrigée dans le bulletin MFSA2008-47 permet à une personne malveillante d'injecter du code arbitraire dans un document chrome et de l'exécuter avec les privilèges chrome ;
un contournement de la protection HTTPOnly permet de lire des fichiers de session via un code JavaScript utilisant certaines API ;
certaines directives HTTP de non mise en cache ne sont pas respectées par le navigateur et permettent de porter atteinte à la confidentialité de données personnelles lorsque le système est partagé entre plusieurs utilisateurs.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Toutes les versions de Firefox 3 antérieures à la version 3.0.6.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

CERTA-2009-AVI-048

Vulnerability from certfr_avis - Published: - Updated:

Plusieurs vulnérabilités affectent Mozilla Firefox et permettent à une personne malintentionnée de réaliser un grand nombre d'actions malveillantes dont exécuter du code arbitraire à distance.

Description

Plusieurs vulnérabilités ont été découvertes dans Mozilla Firefox :

plusieurs erreurs dans la gestion de la mémoire permettent de réaliser un déni de service ou une exécution de code arbitraire à distance ;
une vulnérabilité affectant une méthode chrome XLB permet d'exécuter du code JavaScript malveillant ;
une erreur dans le système de restauration des sessions permet à une personne malintentionnée de récupérer des données dans un fichier stocké en local lors de la réouverture des onglets sauvegardés ;
un contournement de la vulnérabilité corrigée dans le bulletin MFSA2008-47 permet à une personne malveillante d'injecter du code arbitraire dans un document chrome et de l'exécuter avec les privilèges chrome ;
un contournement de la protection HTTPOnly permet de lire des fichiers de session via un code JavaScript utilisant certaines API ;
certaines directives HTTP de non mise en cache ne sont pas respectées par le navigateur et permettent de porter atteinte à la confidentialité de données personnelles lorsque le système est partagé entre plusieurs utilisateurs.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Toutes les versions de Firefox 3 antérieures à la version 3.0.6.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

FKIE_CVE-2009-0354

Vulnerability from fkie_nvd - Published: 2009-02-04 19:30 - Updated: 2026-06-16 23:04

Severity

Summary

References

URL	Tags
secalert@redhat.com	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2009-0256.html
secalert@redhat.com	http://secunia.com/advisories/33799
secalert@redhat.com	http://secunia.com/advisories/33809
secalert@redhat.com	http://secunia.com/advisories/33831
secalert@redhat.com	http://secunia.com/advisories/33841
secalert@redhat.com	http://secunia.com/advisories/33846
secalert@redhat.com	http://secunia.com/advisories/33869
secalert@redhat.com	http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm
secalert@redhat.com	http://www.mandriva.com/security/advisories?name=MDVSA-2009:044
secalert@redhat.com	http://www.mozilla.org/security/announce/2009/mfsa2009-02.html	Vendor Advisory
secalert@redhat.com	http://www.securityfocus.com/bid/33598
secalert@redhat.com	http://www.securitytracker.com/id?1021664
secalert@redhat.com	http://www.ubuntu.com/usn/usn-717-1
secalert@redhat.com	http://www.vupen.com/english/advisories/2009/0313
secalert@redhat.com	https://bugzilla.mozilla.org/show_bug.cgi?id=468581
secalert@redhat.com	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796
secalert@redhat.com	https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2009-0256.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/33799
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/33809
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/33831
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/33841
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/33846
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/33869
af854a3a-2127-422b-91ae-364da2661108	http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm
af854a3a-2127-422b-91ae-364da2661108	http://www.mandriva.com/security/advisories?name=MDVSA-2009:044
af854a3a-2127-422b-91ae-364da2661108	http://www.mozilla.org/security/announce/2009/mfsa2009-02.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/33598
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id?1021664
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/usn-717-1
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2009/0313
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.mozilla.org/show_bug.cgi?id=468581
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796
af854a3a-2127-422b-91ae-364da2661108	https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html

Impacted products

Vendor	Product	Version
mozilla	firefox	3.0
mozilla	firefox	3.0
mozilla	firefox	3.0
mozilla	firefox	3.0
mozilla	firefox	3.0.1
mozilla	firefox	3.0.2
mozilla	firefox	3.0.3
mozilla	firefox	3.0.4
mozilla	firefox	3.0.5

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "412DF091-7604-4110-87A0-3488116A97E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "7A1DE6AC-C6AA-4B27-AC21-3293E5357A7E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "13AAF607-AEEE-4FAF-BE63-73B1D951EF52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "20139741-10B1-4E4B-8D5F-A715042049C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "63DF3D65-C992-44CF-89B4-893526C6242E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9024117-2E8B-4240-9E21-CC501F3879B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de dominio cruzado en js/src/jsobj.cpp en Mozilla Firefox v3.x anterior a v3.0.6 permite a atacantes remotos evitar la Pol\u00edtica de Mismo Origen (Same Origin Policy) , acceder a las propiedades de cualquier ventana de su elecci\u00f3n y llevar a cabo ataques de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) a trav\u00e9s de vectores que involucran al m\u00e9todo Chrome XBL y a la funci\u00f3n window.eval."
    }
  ],
  "id": "CVE-2009-0354",
  "lastModified": "2026-06-16T23:04:50.823",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.6,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-02-04T19:30:00.420",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/33799"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/33809"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/33831"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/33841"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/33846"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/33869"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/33598"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id?1021664"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/usn-717-1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2009/0313"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33799"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33809"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33831"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33841"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33846"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/33869"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/33598"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1021664"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/usn-717-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/0313"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-F7GF-49MV-Q3M5

Vulnerability from github – Published: 2022-05-02 03:14 – Updated: 2022-05-02 03:14

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2009-0354"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-02-04T19:30:00Z",
    "severity": "LOW"
  },
  "details": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.",
  "id": "GHSA-f7gf-49mv-q3m5",
  "modified": "2022-05-02T03:14:35Z",
  "published": "2022-05-02T03:14:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0354"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2009:0256"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2009-0354"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=483142"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33799"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33809"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33831"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33841"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33846"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33869"
    },
    {
      "type": "WEB",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
    },
    {
      "type": "WEB",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/33598"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1021664"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/usn-717-1"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/0313"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2009-0354

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2009-0354

Aliases

CVE-2009-0354

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2009-0354",
    "description": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.",
    "id": "GSD-2009-0354",
    "references": [
      "https://www.suse.com/security/cve/CVE-2009-0354.html",
      "https://access.redhat.com/errata/RHSA-2009:0256",
      "https://linux.oracle.com/cve/CVE-2009-0354.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2009-0354"
      ],
      "details": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function.",
      "id": "GSD-2009-0354",
      "modified": "2023-12-13T01:19:44.672062Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2009-0354",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html",
            "refsource": "MISC",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2009-0256.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
          },
          {
            "name": "http://secunia.com/advisories/33799",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/33799"
          },
          {
            "name": "http://secunia.com/advisories/33809",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/33809"
          },
          {
            "name": "http://secunia.com/advisories/33831",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/33831"
          },
          {
            "name": "http://secunia.com/advisories/33841",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/33841"
          },
          {
            "name": "http://secunia.com/advisories/33846",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/33846"
          },
          {
            "name": "http://secunia.com/advisories/33869",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/33869"
          },
          {
            "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm",
            "refsource": "MISC",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
          },
          {
            "name": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044",
            "refsource": "MISC",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
          },
          {
            "name": "http://www.securityfocus.com/bid/33598",
            "refsource": "MISC",
            "url": "http://www.securityfocus.com/bid/33598"
          },
          {
            "name": "http://www.ubuntu.com/usn/usn-717-1",
            "refsource": "MISC",
            "url": "http://www.ubuntu.com/usn/usn-717-1"
          },
          {
            "name": "http://www.vupen.com/english/advisories/2009/0313",
            "refsource": "MISC",
            "url": "http://www.vupen.com/english/advisories/2009/0313"
          },
          {
            "name": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html",
            "refsource": "MISC",
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
          },
          {
            "name": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html",
            "refsource": "MISC",
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
          },
          {
            "name": "http://www.securitytracker.com/id?1021664",
            "refsource": "MISC",
            "url": "http://www.securitytracker.com/id?1021664"
          },
          {
            "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581",
            "refsource": "MISC",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
          },
          {
            "name": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796",
            "refsource": "MISC",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2009-0354"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripting (XSS) attacks, via vectors involving a chrome XBL method and the window.eval function."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-02.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=468581"
            },
            {
              "name": "33598",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/33598"
            },
            {
              "name": "33799",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/33799"
            },
            {
              "name": "33809",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/33809"
            },
            {
              "name": "1021664",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id?1021664"
            },
            {
              "name": "RHSA-2009:0256",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2009-0256.html"
            },
            {
              "name": "33869",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/33869"
            },
            {
              "name": "USN-717-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/usn-717-1"
            },
            {
              "name": "MDVSA-2009:044",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:044"
            },
            {
              "name": "33841",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/33841"
            },
            {
              "name": "FEDORA-2009-1399",
              "refsource": "FEDORA",
              "tags": [],
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html"
            },
            {
              "name": "33831",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/33831"
            },
            {
              "name": "33846",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/33846"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm"
            },
            {
              "name": "ADV-2009-0313",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2009/0313"
            },
            {
              "name": "SUSE-SA:2009:009",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html"
            },
            {
              "name": "oval:org.mitre.oval:def:9796",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9796"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 4.9,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2023-02-13T01:17Z",
      "publishedDate": "2009-02-04T19:30Z"
    }
  }
}

OPENSUSE-SU-2024:10600-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

MozillaFirefox-92.0-1.2 on GA media

Severity

Moderate

Scope

661 vulnerabilities in this advisory, including CVE-2009-0354.

CVE-2009-0354

Recommended: 20 products

Open the full advisory

OPENSUSE-SU-2024:14572-1

Vulnerability from csaf_opensuse - Published: 2024-12-12 00:00 - Updated: 2024-12-12 00:00

Summary

firefox-esr-128.5.1-1.1 on GA media

Severity

Moderate

Scope

1860 vulnerabilities in this advisory, including CVE-2009-0354.

CVE-2009-0354

Recommended: 16 products

Open the full advisory

RHSA-2009:0256

Vulnerability from csaf_redhat - Published: 2009-02-04 08:59 - Updated: 2026-06-25 10:35

Summary

Red Hat Security Advisory: firefox security update

Severity

Critical

Scope

7 vulnerabilities in this advisory, including CVE-2009-0354.

CVE-2009-0354

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:P/A:N

Fixed: 199 products

https://access.redhat.com/errata/RHSA-2009:0256

Open the full advisory

RHSA-2009_0256

Vulnerability from csaf_redhat - Published: 2009-02-04 08:59 - Updated: 2024-11-22 02:28

Summary

Red Hat Security Advisory: firefox security update

Severity

Critical

Scope

7 vulnerabilities in this advisory, including CVE-2009-0354.

CVE-2009-0354

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:P/A:N

Fixed: 369 products

https://access.redhat.com/errata/RHSA-2009:0256

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2009-0354 (GCVE-0-2009-0354)

Description

Solution

Description

Solution

Tags

Sightings

Nomenclature

Related by attack behaviour