CVSS: 5.8EPSS: 0%CPEs: 88EXPL: 0CVE-2009-0652 – firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)
https://notcve.org/view.php?id=CVE-2009-0652
The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by homoglyphs of the / (slash) and ? (question mark) characters in a subdomain of a .cn domain name, a different vulnerability than CVE-2005-0233. NOTE: some third parties claim that 3.0.6 is not affected, but much older versions perhaps are affected. La lista negra de Internationalized Domain Names (IDN) en Mozilla Firefox versión 3.0.6 y otras versiones anteriores a 3.0.9; Thunderbird anterior a versión 2.0.0.21; y SeaMonkey anterior a versión 1.1.15, no incluye caracteres box-drawing, lo que permite a los atacantes remotos falsificar URL y conducir ataques de phishing, como es demostrado por homoglifos de / (barra lateral) y caracteres ? (signo de interrogación) en un subdominio de un nombre de dominio .cn, una vulnerabilidad diferente de CVE-2005-0233. • http://lists.immunitysec.com/pipermail/dailydave/2009-February/005556.html http://lists.immunitysec.com/pipermail/dailydave/2009-February/005563.html http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://rhn.redhat.com/errata/RHSA-2009-0437.html http://secunia.com/advisories/34096 http://secunia.com/advisories/34843 http://secunia.com/advisories/34844 http://secunia.com/advisories/34894 http://secunia.com/advisories/35042 http://secunia.com/advisories/35065 http& •
CVSS: 10.0EPSS: 45%CPEs: 70EXPL: 0CVE-2009-0352 – Firefox layout crashes with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2009-0352
Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and destruction of arbitrary layout objects by the nsViewManager::Composite function. Múltiples vulnerabilidades no especificadas en Mozilla Firefox 3.x antes de 3.0.6, Thunderbird antes de 2.0.0.21, y SeaMonkey antes de 1.1.15, permiten a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código de su elección mediante vectores relacionados con el diseño del motor y la destrucción arbitraria de objetos de diseño por la función nsViewManager::Composite. • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html http://rhn.redhat.com/errata/RHSA-2009-0256.html http://secunia.com/advisories/33799 http://secunia.com/advisories/33802 http://secunia.com/advisories/33808 http://secunia.com/advisories/33809 http://secunia.com/advisories/33816 http://secunia.com/advisories/33831 http://secunia.com/advisories/33841 http://secunia.com/advisories/33846 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 98EXPL: 0CVE-2009-0357 – Firefox XMLHttpRequest allows reading HTTPOnly cookies
https://notcve.org/view.php?id=CVE-2009-0357
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism. Mozilla Firefox anterior a v3.06 y SeaMonkey anterior a v1.1.15 no restringe adecuadamente el acceso desde las páginas web a las cabeceras de respuesta HTTP (1) Set-Cookie y (2) Set-Cookie2, lo que permite a atacantes remotos obtener información sensible de las cookies a través de llamadas XMLHttpRequest, relacionado con el mecanismo de protección HTTPOnly. • http://ha.ckers.org/blog/20070511/bluehat-errata http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html http://rhn.redhat.com/errata/RHSA-2009-0256.html http://secunia.com/advisories/33799 http://secunia.com/advisories/33808 http://secunia.com/advisories/33809 http://secunia.com/advisories/33816 http://secunia.com/advisories/33831 http://secunia.com/advisories/33841 http://secunia.com/advisories/33846 http://secunia.com/advisories/33869 http://secunia. • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.1EPSS: 18%CPEs: 93EXPL: 0CVE-2009-0356 – Firefox Chrome privilege escalation via local .desktop files
https://notcve.org/view.php?id=CVE-2009-0356
Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file, related to representation of about: URIs as jar:file:// URIs. NOTE: this issue exists because of an incomplete fix for CVE-2008-4582. Mozilla Firefox en versiones anteriores a v3.0.6 y SeaMonkey no bloquean enlaces a las URIs (1) about:plugins y (2) about:config desde ficheros .desktop, lo que permite a atacantes remotos eludir la Same Origin Policy y ejecutar código de su elección con privilegios chrome mediante vectores relacionados con el campo URL en una sección Desktop Entry de un fichero .desktop, en relación con una representación de: URIs como jar:file:// URIs. NOTA: este problema existe debido a una resolución incompleta de CVE-2008-4582. • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html http://rhn.redhat.com/errata/RHSA-2009-0256.html http://secunia.com/advisories/33799 http://secunia.com/advisories/33809 http://secunia.com/advisories/33831 http://secunia.com/advisories/33841 http://secunia.com/advisories/33846 http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm http://www.mandriva.com/security/advisories?name=MDVSA-2009:044 http://www.mozilla.org/security/announce/2009/mfsa2009- • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 10.0EPSS: 48%CPEs: 70EXPL: 0CVE-2009-0353 – Firefox javascript crashes with evidence of memory corruption
https://notcve.org/view.php?id=CVE-2009-0353
Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine. Vulnerabilidad sin especificar en Mozilla Firefox v3.x anterior a v3.0.6, Thunderbird anterior a v2.0.0.21, y SeaMonkey anterior a v1.1.15 permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria y caída de aplicación)o posiblemente ejecutar código de su elección a través de vectores relacionados con el motor JavaScript. • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html http://rhn.redhat.com/errata/RHSA-2009-0256.html http://secunia.com/advisories/33799 http://secunia.com/advisories/33802 http://secunia.com/advisories/33808 http://secunia.com/advisories/33809 http://secunia.com/advisories/33816 http://secunia.com/advisories/33831 http://secunia.com/advisories/33841 http://secunia.com/advisories/33846 • CWE-399: Resource Management Errors •