CVSS: 6.8EPSS: 1%CPEs: 94EXPL: 0CVE-2009-1307 – view-source: protocol
https://notcve.org/view.php?id=CVE-2009-1307
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI. La implementación view-source: URI en Mozilla Firefox anteriores a v3.0.9, Thunderbird, and SeaMonkey no implementa correctamente la política de mismo origen, permitiendo a atacantes remotos (1) saltar las restricciones crossdomain.xml y conectar a sitios web de su elección utilizando un fichero Flash; (2) leer, crear o modificar objetos compartidos locales utilizando un fichero Flash; o (3) saltar restricciones no especificadas y generar contenido mediante vectores relacionados con jar: URI. • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://rhn.redhat.com/errata/RHSA-2009-0437.html http://secunia.com/advisories/34758 http://secunia.com/advisories/34780 http://secunia.com/advisories/34843 http://secunia.com/advisories/34844 http://secunia.com/advisories/34894 http://secunia.com/advisories/35042 http://secunia.com/advisories/35065 http://secunia.com/advisories/35536 http://secunia.com/advisories/35561 http://secunia.com/advisories/3 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 7%CPEs: 77EXPL: 5CVE-2009-1302 – Firefox 3 Layout engine crashes
https://notcve.org/view.php?id=CVE-2009-1302
The browser engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors related to (1) nsAsyncInstantiateEvent::Run, (2) nsStyleContext::Destroy, (3) nsComputedDOMStyle::GetWidth, (4) the xslt_attributeset_ImportSameName.html test case for the XSLT stylesheet compiler, (5) nsXULDocument::SynchronizeBroadcastListener, (6) IsBindingAncestor, (7) PL_DHashTableOperate and nsEditor::EndUpdateViewBatch, and (8) gfxSkipCharsIterator::SetOffsets, and other vectors. El motor del navegador Mozilla Firefox v3.x anteriores a la v3.0.9, Thunderbird anteriores a la v2.0.0.22, y SeaMonkey anteriores a v1.1.16 permite a atacantes remotos producir una denegación de servicio (caída de aplicación) y posiblemente inicia una corrupción de memoria a través de vectores relacionados con (1) nsAsyncInstantiateEvent::Run, (2) nsStyleContext::Destroy, (3) nsComputedDOMStyle::GetWidth, (4) caso de pueba xslt_attributeset_ImportSameName.html para el compilador XSLT stylesheet , (5) nsXULDocument::SynchronizeBroadcastListener, (6) IsBindingAncestor, (7) PL_DHashTableOperate y nsEditor::EndUpdateViewBatch, y (8) gfxSkipCharsIterator::SetOffsets, y otros vectores. • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://secunia.com/advisories/34758 http://secunia.com/advisories/34780 http://secunia.com/advisories/34843 http://secunia.com/advisories/34894 http://secunia.com/advisories/35042 http://secunia.com/advisories/35065 http://secunia.com/advisories/35602 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 http://www.debian.org/security/2009/dsa-1797 http://www.debian.org/security/2009/dsa • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 0CVE-2009-1309 – Firefox Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString
https://notcve.org/view.php?id=CVE-2009-1309
Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involving an incorrect __proto__ scope, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via a crafted document. Mozilla Firefox anteriores a 3.0.9, Thunderbird, y SeaMonkey no implementan correctamente la política de mismo origen para (1) XMLHttpRequest, suponiendo una perdida del documento principal, y (2) XPCNativeWrapper.toString, suponiendo un alcance _proto_ incorrecto, permitiendo a atacantes remotos con la intervención del usuario realizar ataques de secuencias de comandos en sitios cruzados (XSS) y posiblemente otros ataques al utilizar documentos manipulados. • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://rhn.redhat.com/errata/RHSA-2009-0437.html http://secunia.com/advisories/34758 http://secunia.com/advisories/34780 http://secunia.com/advisories/34843 http://secunia.com/advisories/34844 http://secunia.com/advisories/34894 http://secunia.com/advisories/35042 http://secunia.com/advisories/35065 http://secunia.com/advisories/35536 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 h • CWE-16: Configuration •
CVSS: 6.8EPSS: 26%CPEs: 77EXPL: 2CVE-2009-1304 – Firefox 3 JavaScript engine crashes
https://notcve.org/view.php?id=CVE-2009-1304
The JavaScript engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors involving (1) js_FindPropertyHelper, related to the definitions of Math and Date; and (2) js_CheckRedeclaration. El motor JavaScript en Mozilla Firefox v3.x en anteriores a v3.0.9, Thunderbird anteriores a v2.0.0.22, y SeaMonkey anteriores a v1.1.16 permite a atacantes remotos producir una denegación de servicio (caída de aplicación) y posiblemente iniciar una corrupción de memoria a través de vectores relacionados con (1) js_FindPropertyHelper, relacionado con las definiciones de "Math" y "Date"; (2) js_CheckRedeclaration. • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://secunia.com/advisories/34758 http://secunia.com/advisories/34780 http://secunia.com/advisories/34843 http://secunia.com/advisories/34894 http://secunia.com/advisories/35042 http://secunia.com/advisories/35065 http://secunia.com/advisories/35602 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 http://www.debian.org/security/2009/dsa-1797 http://www.mandriva.com/security/advisories& • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 1CVE-2009-1308 – Firefox XSS hazard using third-party stylesheets and XBL bindings
https://notcve.org/view.php?id=CVE-2009-1308
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, as exploited in the wild by a March 2009 eBay listing. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Mozilla Firefox anteriores a 3.0.9, Thunderbird, y SeaMonkey permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores involucrados con enlaces XBL JavaScript y hojas de estilo remotas, como ha sido explotado por una lista de eBay en Marzo de 2009. • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://secunia.com/advisories/34758 http://secunia.com/advisories/34780 http://secunia.com/advisories/34843 http://secunia.com/advisories/34894 http://secunia.com/advisories/35042 http://secunia.com/advisories/35065 http://secunia.com/advisories/35536 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 http://www.debian.org/security/2009/dsa-1797 http://www.mandriva.com/security/advisories& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •