cvelistv5 - cve-2009-1307

CVE-2009-1307 (GCVE-0-2009-1307)

Vulnerability from cvelistv5

Published

2009-04-22 18:00

Modified

2024-08-07 05:04

Severity ?

CWE

Summary

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI.

References

URL

Tags

	http://www.mozilla.org/security/announce/2009/mfsa2009-17.html	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:111	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html	vendor-advisory, x_refsource_FEDORA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6154	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/34894	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/1125	vdb-entry, x_refsource_VUPEN
	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275	vendor-advisory, x_refsource_SLACKWARE
	http://www.debian.org/security/2009/dsa-1830	vendor-advisory, x_refsource_DEBIAN
	http://secunia.com/advisories/34758	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/35536	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10972	vdb-entry, signature, x_refsource_OVAL
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7008	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/35602	third-party-advisory, x_refsource_SECUNIA
	http://www.redhat.com/support/errata/RHSA-2009-1125.html	vendor-advisory, x_refsource_REDHAT
	https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/34844	third-party-advisory, x_refsource_SECUNIA
	http://www.ubuntu.com/usn/usn-782-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/35065	third-party-advisory, x_refsource_SECUNIA
	http://www.securitytracker.com/id?1022093	vdb-entry, x_refsource_SECTRACK
	https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/35882	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6266	vdb-entry, signature, x_refsource_OVAL
	https://usn.ubuntu.com/764-1/	vendor-advisory, x_refsource_UBUNTU
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:141	vendor-advisory, x_refsource_MANDRIVA
	http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html	vendor-advisory, x_refsource_SUSE
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5933	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/35042	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/bid/34656	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/34843	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2009/dsa-1797	vendor-advisory, x_refsource_DEBIAN
	http://secunia.com/advisories/35561	third-party-advisory, x_refsource_SECUNIA
	http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408	vendor-advisory, x_refsource_SLACKWARE
	http://rhn.redhat.com/errata/RHSA-2009-0437.html	vendor-advisory, x_refsource_REDHAT
	http://www.redhat.com/support/errata/RHSA-2009-0436.html	vendor-advisory, x_refsource_REDHAT
	http://www.redhat.com/support/errata/RHSA-2009-1126.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/34780	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1	vendor-advisory, x_refsource_SUNALERT
	https://bugzilla.mozilla.org/show_bug.cgi?id=481342	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:04:49.691Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-17.html"
          },
          {
            "name": "MDVSA-2009:111",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:111"
          },
          {
            "name": "FEDORA-2009-3875",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html"
          },
          {
            "name": "oval:org.mitre.oval:def:6154",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6154"
          },
          {
            "name": "34894",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34894"
          },
          {
            "name": "ADV-2009-1125",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1125"
          },
          {
            "name": "SSA:2009-178-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.454275"
          },
          {
            "name": "DSA-1830",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1830"
          },
          {
            "name": "34758",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34758"
          },
          {
            "name": "35536",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35536"
          },
          {
            "name": "oval:org.mitre.oval:def:10972",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10972"
          },
          {
            "name": "oval:org.mitre.oval:def:7008",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7008"
          },
          {
            "name": "35602",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35602"
          },
          {
            "name": "RHSA-2009:1125",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1125.html"
          },
          {
            "name": "FEDORA-2009-7614",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html"
          },
          {
            "name": "34844",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34844"
          },
          {
            "name": "USN-782-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-782-1"
          },
          {
            "name": "35065",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35065"
          },
          {
            "name": "1022093",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022093"
          },
          {
            "name": "FEDORA-2009-7567",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html"
          },
          {
            "name": "35882",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35882"
          },
          {
            "name": "oval:org.mitre.oval:def:6266",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6266"
          },
          {
            "name": "USN-764-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/764-1/"
          },
          {
            "name": "MDVSA-2009:141",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:141"
          },
          {
            "name": "SUSE-SR:2009:010",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html"
          },
          {
            "name": "oval:org.mitre.oval:def:5933",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5933"
          },
          {
            "name": "35042",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35042"
          },
          {
            "name": "34656",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34656"
          },
          {
            "name": "34843",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34843"
          },
          {
            "name": "DSA-1797",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1797"
          },
          {
            "name": "35561",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35561"
          },
          {
            "name": "SSA:2009-176-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.425408"
          },
          {
            "name": "RHSA-2009:0437",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2009-0437.html"
          },
          {
            "name": "RHSA-2009:0436",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-0436.html"
          },
          {
            "name": "RHSA-2009:1126",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1126.html"
          },
          {
            "name": "34780",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34780"
          },
          {
            "name": "264308",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=481342"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-04-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-03T20:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-17.html"
        },
        {
          "name": "MDVSA-2009:111",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:111"
        },
        {
          "name": "FEDORA-2009-3875",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html"
        },
        {
          "name": "oval:org.mitre.oval:def:6154",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6154"
        },
        {
          "name": "34894",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34894"
        },
        {
          "name": "ADV-2009-1125",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1125"
        },
        {
          "name": "SSA:2009-178-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.454275"
        },
        {
          "name": "DSA-1830",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1830"
        },
        {
          "name": "34758",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34758"
        },
        {
          "name": "35536",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35536"
        },
        {
          "name": "oval:org.mitre.oval:def:10972",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10972"
        },
        {
          "name": "oval:org.mitre.oval:def:7008",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7008"
        },
        {
          "name": "35602",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35602"
        },
        {
          "name": "RHSA-2009:1125",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1125.html"
        },
        {
          "name": "FEDORA-2009-7614",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html"
        },
        {
          "name": "34844",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34844"
        },
        {
          "name": "USN-782-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-782-1"
        },
        {
          "name": "35065",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35065"
        },
        {
          "name": "1022093",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022093"
        },
        {
          "name": "FEDORA-2009-7567",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html"
        },
        {
          "name": "35882",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35882"
        },
        {
          "name": "oval:org.mitre.oval:def:6266",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6266"
        },
        {
          "name": "USN-764-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/764-1/"
        },
        {
          "name": "MDVSA-2009:141",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:141"
        },
        {
          "name": "SUSE-SR:2009:010",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html"
        },
        {
          "name": "oval:org.mitre.oval:def:5933",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5933"
        },
        {
          "name": "35042",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35042"
        },
        {
          "name": "34656",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34656"
        },
        {
          "name": "34843",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34843"
        },
        {
          "name": "DSA-1797",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1797"
        },
        {
          "name": "35561",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35561"
        },
        {
          "name": "SSA:2009-176-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.425408"
        },
        {
          "name": "RHSA-2009:0437",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2009-0437.html"
        },
        {
          "name": "RHSA-2009:0436",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-0436.html"
        },
        {
          "name": "RHSA-2009:1126",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1126.html"
        },
        {
          "name": "34780",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34780"
        },
        {
          "name": "264308",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=481342"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-1307",
    "datePublished": "2009-04-22T18:00:00.000Z",
    "dateReserved": "2009-04-16T00:00:00.000Z",
    "dateUpdated": "2024-08-07T05:04:49.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2009-AVI-157

Vulnerability from certfr_avis

Plusieurs vulnérabilités ont été identifiées dans le navigateur Mozilla Firefox. L'exploitation de celles-ci peut avoir des conséquences variées, du contournement de la politique de sécurité mise en place à l'exécutation de code arbitraire au cours d'une navigation sur une page spécialement construite.

Description

Plusieurs vulnérabilités ont été identifiées dans le navigateur Mozilla Firefox. Parmi celles-ci :

le moteur de navigation Mozilla manipule incorrectement certaines pages Web lorsque l'interprétation de code Javascript est active. Cela provoque une corruption de la mémoire pouvant conduire, sous certaines conditions, à l'exécution de code arbitraire à distance ;
l'interprétation de certains caractères graphiques est prise en compte par l'IDN (International Domain Names) et peut ainsi être détournée pour favoriser des attaques en filoutage (phishing) ;
le module Flash confond l'origine du contenu sous certaines conditions, ce qui permet alors au code interprété d'accéder illégitimement à certaines ressources (accès arbitraires en lecture et écriture des Local Shared Objects par exemple) ;
le navigateur ne manipule pas correctement les données de rafraichissement dans les en-têtes (Refresh) permettant à une page malveillante de lancer des attaques par injection de code indirecte ou à forcer, sous certaines conditions, le navigateur à interpréter du code JavaScript arbitraire dans le contexte d'un site victime.

Solution

Se référer aux avis de sécurité de Mozilla pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Mozilla	Firefox	Les versions de Mozilla Firefox antérieures à 3.0.9.

References

Title

Publication Time

Tags

Notes de mise à jour Mozilla Firefox 3.0.9 du 21 avril 2009	None	vendor-advisory
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-19 du 21 avril 2009 :	-	other
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-16 du 21 avril 2009 :	-	other
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-14 du 21 avril 2009 :	-	other
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-17 du 21 avril 2009 :	-	other
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-21 du 21 avril 2009 :	-	other
Avis de sécurité Mozilla pour Firefox 3.0 :	-	other
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-15 du 21 avril 2009 :	-	other
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-20 du 21 avril 2009 :	-	other
Notes de mise à jour Mozilla Firefox 3.0.9 du 21 avril 2009 :	-	other
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-18 du 21 avril 2009 :	-	other
Bulletin de sécurité de la fondation Mozilla 2009/mfsa2009-22 du 21 avril 2009 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Les versions de Mozilla Firefox ant\u00e9rieures \u00e0 3.0.9.",
      "product": {
        "name": "Firefox",
        "vendor": {
          "name": "Mozilla",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le navigateur Mozilla\nFirefox. Parmi celles-ci\u00a0:\n\n-   le moteur de navigation Mozilla manipule incorrectement certaines\n    pages Web lorsque l\u0027interpr\u00e9tation de code Javascript est active.\n    Cela provoque une corruption de la m\u00e9moire pouvant conduire, sous\n    certaines conditions, \u00e0 l\u0027ex\u00e9cution de code arbitraire \u00e0 distance\u00a0;\n-   l\u0027interpr\u00e9tation de certains caract\u00e8res graphiques est prise en\n    compte par l\u0027IDN (International Domain Names) et peut ainsi \u00eatre\n    d\u00e9tourn\u00e9e pour favoriser des attaques en filoutage (phishing)\u00a0;\n-   le module Flash confond l\u0027origine du contenu sous certaines\n    conditions, ce qui permet alors au code interpr\u00e9t\u00e9 d\u0027acc\u00e9der\n    ill\u00e9gitimement \u00e0 certaines ressources (acc\u00e8s arbitraires en lecture\n    et \u00e9criture des Local Shared Objects par exemple)\u00a0;\n-   le navigateur ne manipule pas correctement les donn\u00e9es de\n    rafraichissement dans les en-t\u00eates (Refresh) permettant \u00e0 une page\n    malveillante de lancer des attaques par injection de code indirecte\n    ou \u00e0 forcer, sous certaines conditions, le navigateur \u00e0 interpr\u00e9ter\n    du code JavaScript arbitraire dans le contexte d\u0027un site victime.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux avis de s\u00e9curit\u00e9 de Mozilla pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-1307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1307"
    },
    {
      "name": "CVE-2009-1304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1304"
    },
    {
      "name": "CVE-2009-0652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0652"
    },
    {
      "name": "CVE-2009-1308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1308"
    },
    {
      "name": "CVE-2009-1312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1312"
    },
    {
      "name": "CVE-2009-1306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1306"
    },
    {
      "name": "CVE-2009-1305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1305"
    },
    {
      "name": "CVE-2009-1311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1311"
    },
    {
      "name": "CVE-2009-1310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1310"
    },
    {
      "name": "CVE-2009-1302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1302"
    },
    {
      "name": "CVE-2009-1303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1303"
    },
    {
      "name": "CVE-2009-1309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1309"
    }
  ],
  "initial_release_date": "2009-04-22T00:00:00",
  "last_revision_date": "2009-04-22T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-19 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-19.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-16 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-16.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-14 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-14.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-17 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-17.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-21 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-21.html"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 Mozilla pour Firefox 3.0\u00a0:",
      "url": "http://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.9"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-15 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-15.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-20 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-20.html"
    },
    {
      "title": "Notes de mise \u00e0 jour Mozilla Firefox 3.0.9 du 21 avril    2009\u00a0:",
      "url": "http://www.mozilla.com/en-US/firefox/3.0.9/releasenotes/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-18 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-18.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-22 du 21 avril 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-22.html"
    }
  ],
  "reference": "CERTA-2009-AVI-157",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-04-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le navigateur Mozilla\nFirefox. L\u0027exploitation de celles-ci peut avoir des cons\u00e9quences\nvari\u00e9es, du contournement de la politique de s\u00e9curit\u00e9 mise en place \u00e0\nl\u0027ex\u00e9cutation de code arbitraire au cours d\u0027une navigation sur une page\nsp\u00e9cialement construite.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Mozilla Firefox",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Notes de mise \u00e0 jour Mozilla Firefox 3.0.9 du 21 avril 2009",
      "url": null
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2009-1307 (GCVE-0-2009-1307)

Vulnerability from cvelistv5

CERTA-2009-AVI-157

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature