Lucene search

RedhatCVE-2009-0776

HistoryMar 05, 2009 - 2:30 a.m.

CVE-2009-0776

2009-03-0502:30:00

CWE-200

redhat

web.nvd.nist.gov

mozilla

firefox

thunderbird

seamonkey

cve-2009-0776

remote code execution

vulnerability

cross-domain redirect

same-origin policy

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:C/I:N/A:N

AI Score

9.2

Confidence

High

EPSS

0.007

Percentile

80.7%

JSON

nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect.

Affected configurations

Nvd

Node

mozillafirefoxRange≤3.0.6

mozillafirefoxMatch1.0

mozillafirefoxMatch1.0.1

mozillafirefoxMatch1.0.2

mozillafirefoxMatch1.0.3

mozillafirefoxMatch1.0.4

mozillafirefoxMatch1.0.5

mozillafirefoxMatch1.0.6

mozillafirefoxMatch1.0.7

mozillafirefoxMatch1.0.8

mozillafirefoxMatch1.5

mozillafirefoxMatch1.5.0.1

mozillafirefoxMatch1.5.0.2

mozillafirefoxMatch1.5.0.3

mozillafirefoxMatch1.5.0.4

mozillafirefoxMatch1.5.0.5

mozillafirefoxMatch1.5.0.6

mozillafirefoxMatch1.5.0.7

mozillafirefoxMatch1.5.0.8

mozillafirefoxMatch1.5.0.9

mozillafirefoxMatch1.5.0.10

mozillafirefoxMatch1.5.0.11

mozillafirefoxMatch1.5.0.12

mozillafirefoxMatch2.0

mozillafirefoxMatch2.0.0.1

mozillafirefoxMatch2.0.0.2

mozillafirefoxMatch2.0.0.3

mozillafirefoxMatch2.0.0.4

mozillafirefoxMatch2.0.0.5

mozillafirefoxMatch2.0.0.6

mozillafirefoxMatch2.0.0.7

mozillafirefoxMatch2.0.0.8

mozillafirefoxMatch2.0.0.9

mozillafirefoxMatch2.0.0.10

mozillafirefoxMatch2.0.0.11

mozillafirefoxMatch2.0.0.12

mozillafirefoxMatch2.0.0.13

mozillafirefoxMatch2.0.0.14

mozillafirefoxMatch2.0.0.15

mozillafirefoxMatch2.0.0.16

mozillafirefoxMatch2.0.0.17

mozillafirefoxMatch2.0.0.18

mozillafirefoxMatch2.0.0.19

mozillafirefoxMatch2.0.0.20

mozillafirefoxMatch3.0

mozillafirefoxMatch3.0.1

mozillafirefoxMatch3.0.2

mozillafirefoxMatch3.0.3

mozillafirefoxMatch3.0.4

mozillafirefoxMatch3.0.5

mozillaseamonkeyRange≤1.1.14

mozillaseamonkeyMatch1.0

mozillaseamonkeyMatch1.0.1

mozillaseamonkeyMatch1.0.2

mozillaseamonkeyMatch1.0.3

mozillaseamonkeyMatch1.0.5

mozillaseamonkeyMatch1.0.6

mozillaseamonkeyMatch1.0.7

mozillaseamonkeyMatch1.0.8

mozillaseamonkeyMatch1.0.9

mozillaseamonkeyMatch1.1

mozillaseamonkeyMatch1.1alpha

mozillaseamonkeyMatch1.1beta

mozillaseamonkeyMatch1.1.1

mozillaseamonkeyMatch1.1.2

mozillaseamonkeyMatch1.1.3

mozillaseamonkeyMatch1.1.4

mozillaseamonkeyMatch1.1.5

mozillaseamonkeyMatch1.1.6

mozillaseamonkeyMatch1.1.7

mozillaseamonkeyMatch1.1.8

mozillaseamonkeyMatch1.1.9

mozillaseamonkeyMatch1.1.10

mozillaseamonkeyMatch1.1.11

mozillaseamonkeyMatch1.1.12

mozillaseamonkeyMatch1.1.13

mozillathunderbirdRange≤2.0.0.20

mozillathunderbirdMatch2.0.0.0

mozillathunderbirdMatch2.0.0.4

mozillathunderbirdMatch2.0.0.5

mozillathunderbirdMatch2.0.0.6

mozillathunderbirdMatch2.0.0.9

mozillathunderbirdMatch2.0.0.12

mozillathunderbirdMatch2.0.0.14

mozillathunderbirdMatch2.0.0.16

mozillathunderbirdMatch2.0.0.17

mozillathunderbirdMatch2.0.0.18

mozillathunderbirdMatch2.0.0.19

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillafirefox1.0cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
mozillafirefox1.0.1cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
mozillafirefox1.0.2cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
mozillafirefox1.0.3cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
mozillafirefox1.0.4cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
mozillafirefox1.0.5cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
mozillafirefox1.0.6cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
mozillafirefox1.0.7cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
mozillafirefox1.0.8cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	firefox	1.0	cpe:2.3:a:mozilla:firefox:1.0:::::::*
mozilla	firefox	1.0.1	cpe:2.3:a:mozilla:firefox:1.0.1:::::::*
mozilla	firefox	1.0.2	cpe:2.3:a:mozilla:firefox:1.0.2:::::::*
mozilla	firefox	1.0.3	cpe:2.3:a:mozilla:firefox:1.0.3:::::::*
mozilla	firefox	1.0.4	cpe:2.3:a:mozilla:firefox:1.0.4:::::::*
mozilla	firefox	1.0.5	cpe:2.3:a:mozilla:firefox:1.0.5:::::::*
mozilla	firefox	1.0.6	cpe:2.3:a:mozilla:firefox:1.0.6:::::::*
mozilla	firefox	1.0.7	cpe:2.3:a:mozilla:firefox:1.0.7:::::::*
mozilla	firefox	1.0.8	cpe:2.3:a:mozilla:firefox:1.0.8:::::::*

Rows per page:

1-10 of 881

References

lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html

lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html

secunia.com/advisories/34137

secunia.com/advisories/34140

secunia.com/advisories/34145

secunia.com/advisories/34272

secunia.com/advisories/34324

secunia.com/advisories/34383

secunia.com/advisories/34387

secunia.com/advisories/34417

secunia.com/advisories/34462

secunia.com/advisories/34464

secunia.com/advisories/34527

slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420

slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.433952

support.avaya.com/elmodocs2/security/ASA-2009-069.htm

support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document

www.debian.org/security/2009/dsa-1751

www.debian.org/security/2009/dsa-1830

www.mandriva.com/security/advisories?name=MDVSA-2009:075

www.mandriva.com/security/advisories?name=MDVSA-2009:083

www.mozilla.org/security/announce/2009/mfsa2009-09.html

www.redhat.com/support/errata/RHSA-2009-0258.html

www.redhat.com/support/errata/RHSA-2009-0315.html

www.redhat.com/support/errata/RHSA-2009-0325.html

www.securityfocus.com/bid/33990

www.securitytracker.com/id?1021797

www.vupen.com/english/advisories/2009/0632

bugzilla.mozilla.org/show_bug.cgi?id=414540

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5956

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6017

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6191

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7390

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9241

usn.ubuntu.com/741-1/

www.redhat.com/archives/fedora-package-announce/2009-March/msg00769.html

www.redhat.com/archives/fedora-package-announce/2009-March/msg00771.html

www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:C/I:N/A:N

AI Score

9.2

Confidence

High

EPSS

0.007

Percentile

80.7%

JSON

Related for CVE-2009-0776