CVSS: 4.3EPSS: 0%CPEs: 132EXPL: 2CVE-2009-1835 – file: resources
https://notcve.org/view.php?id=CVE-2009-1835
Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with file://example.com/C:/ at the beginning. Mozilla Firefox anteriores a v3.0.11 y SeaMonkey anteriores a v1.1.17 asocian documentos locales con un dominio de nombres externo localizado después de la subcadena "file://" en una URL, lo que permite a atacantes remotos ayudados por el usuario leer cookies de forma arbitraria a través de un documento HTML manipulado, como se demostró mediante una URL con file://examplo.com/C:/ al principio. • http://osvdb.org/55161 http://rhn.redhat.com/errata/RHSA-2009-1096.html http://secunia.com/advisories/35331 http://secunia.com/advisories/35415 http://secunia.com/advisories/35428 http://secunia.com/advisories/35431 http://secunia.com/advisories/35439 http://secunia.com/advisories/35468 http://secunia.com/advisories/35561 http://secunia.com/advisories/35882 http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468 http://slackware.com&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 1%CPEs: 202EXPL: 2CVE-2009-1836 – Firefox SSL tampering via non-200 responses to proxy CONNECT requests
https://notcve.org/view.php?id=CVE-2009-1836
Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack. Mozilla Firefox anteriores a v3.0.11, Thunderbird anteriores a v2.0.0.22, y SeaMonkey anteriores a v1.1.17 utilizan la cabecera HTTP del servidor para determinar el contexto de un documento facilitado mediante una respuesta CONNECT no 200 desde un servidor proxy, lo que permite a atacantes "man-in-the-middle" ejecutar secuencias de comandos web arbitrarios mediante la modificación de la respuesta CONNECT, también conocido como ataque "forzado SSL". • http://osvdb.org/55160 http://research.microsoft.com/apps/pubs/default.aspx?id=79323 http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf http://secunia.com/advisories/35331 http://secunia.com/advisories/35415 http://secunia.com/advisories/35431 http://secunia.com/advisories/35439 http://secunia.com/advisories/35440 http://secunia.com/advisories/35468 http://secunia.com/advisories/35536 http://secunia.com/advisories/35561 http://secunia.com/advisories/35602 • CWE-287: Improper Authentication •
CVSS: 9.3EPSS: 92%CPEs: 112EXPL: 11CVE-2009-1392 – Firefox browser engine crashes
https://notcve.org/view.php?id=CVE-2009-1392
The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsEventStateManager::GetContentState and nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames and ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, related to the atom table, DOM mutation events, and Unicode surrogates; (8) nsHTMLEditor::HideResizers; and (9) nsWindow::SetCursor, related to changing the cursor; and other vectors. El motor del navegador en Mozilla Firefox v3 anteriores a v3.0.11, Thunderbird anteriores a 2.0.0.22, y SeaMonkey anteriores a 1.1.17 permite a atacantes remotos producir una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente ejecutar código arbitrario a través de vectores relacionados con (1) nsEventStateManager::GetContentState y nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames y ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, relacionado con la tabla atom, eventos de mutacion DOM, y subrrogados Unicode; (8) nsHTMLEditor::HideResizers; y (9) nsWindow::SetCursor, relacionado con el cambio de cursor; y otros vectores. • http://osvdb.org/55144 http://osvdb.org/55145 http://osvdb.org/55146 http://osvdb.org/55147 http://rhn.redhat.com/errata/RHSA-2009-1096.html http://secunia.com/advisories/35331 http://secunia.com/advisories/35415 http://secunia.com/advisories/35428 http://secunia.com/advisories/35431 http://secunia.com/advisories/35439 http://secunia.com/advisories/35440 http://secunia.com/advisories/35468 http://secunia.com/advisories/35536 http://secunia.com/advisories/3 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 1%CPEs: 94EXPL: 0CVE-2009-1307 – view-source: protocol
https://notcve.org/view.php?id=CVE-2009-1307
The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI. La implementación view-source: URI en Mozilla Firefox anteriores a v3.0.9, Thunderbird, and SeaMonkey no implementa correctamente la política de mismo origen, permitiendo a atacantes remotos (1) saltar las restricciones crossdomain.xml y conectar a sitios web de su elección utilizando un fichero Flash; (2) leer, crear o modificar objetos compartidos locales utilizando un fichero Flash; o (3) saltar restricciones no especificadas y generar contenido mediante vectores relacionados con jar: URI. • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://rhn.redhat.com/errata/RHSA-2009-0437.html http://secunia.com/advisories/34758 http://secunia.com/advisories/34780 http://secunia.com/advisories/34843 http://secunia.com/advisories/34844 http://secunia.com/advisories/34894 http://secunia.com/advisories/35042 http://secunia.com/advisories/35065 http://secunia.com/advisories/35536 http://secunia.com/advisories/35561 http://secunia.com/advisories/3 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 7%CPEs: 77EXPL: 5CVE-2009-1302 – Firefox 3 Layout engine crashes
https://notcve.org/view.php?id=CVE-2009-1302
The browser engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption via vectors related to (1) nsAsyncInstantiateEvent::Run, (2) nsStyleContext::Destroy, (3) nsComputedDOMStyle::GetWidth, (4) the xslt_attributeset_ImportSameName.html test case for the XSLT stylesheet compiler, (5) nsXULDocument::SynchronizeBroadcastListener, (6) IsBindingAncestor, (7) PL_DHashTableOperate and nsEditor::EndUpdateViewBatch, and (8) gfxSkipCharsIterator::SetOffsets, and other vectors. El motor del navegador Mozilla Firefox v3.x anteriores a la v3.0.9, Thunderbird anteriores a la v2.0.0.22, y SeaMonkey anteriores a v1.1.16 permite a atacantes remotos producir una denegación de servicio (caída de aplicación) y posiblemente inicia una corrupción de memoria a través de vectores relacionados con (1) nsAsyncInstantiateEvent::Run, (2) nsStyleContext::Destroy, (3) nsComputedDOMStyle::GetWidth, (4) caso de pueba xslt_attributeset_ImportSameName.html para el compilador XSLT stylesheet , (5) nsXULDocument::SynchronizeBroadcastListener, (6) IsBindingAncestor, (7) PL_DHashTableOperate y nsEditor::EndUpdateViewBatch, y (8) gfxSkipCharsIterator::SetOffsets, y otros vectores. • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://secunia.com/advisories/34758 http://secunia.com/advisories/34780 http://secunia.com/advisories/34843 http://secunia.com/advisories/34894 http://secunia.com/advisories/35042 http://secunia.com/advisories/35065 http://secunia.com/advisories/35602 http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1 http://www.debian.org/security/2009/dsa-1797 http://www.debian.org/security/2009/dsa • CWE-399: Resource Management Errors •