CVE-2009-0357
Fixed in a distro release EPSS 2%
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
Products: mozilla firefox, mozilla seamonkey
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 2.1 | seamonkey | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-chat | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-devel | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-dom-inspector | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-js-debugger | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-mail | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-nspr | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-nspr-devel | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-nss | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 2.1 | seamonkey-nss-devel | 0:1.0.9-0.27.el2 |
| Red Hat Enterprise Linux 3 | seamonkey | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-chat | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-debuginfo | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-devel | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-dom-inspector | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-js-debugger | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-mail | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nspr | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nspr-devel | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nss | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nss-devel | 0:1.0.9-0.32.el3 |
| Red Hat Enterprise Linux 4 | firefox | 0:3.0.6-1.el4 |
| Red Hat Enterprise Linux 4 | firefox-debuginfo | 0:3.0.6-1.el4 |
| Red Hat Enterprise Linux 4 | nss | 0:3.12.2.0-3.el4 |
| Red Hat Enterprise Linux 4 | nss-debuginfo | 0:3.12.2.0-3.el4 |
| Red Hat Enterprise Linux 4 | nss-devel | 0:3.12.2.0-3.el4 |
| Red Hat Enterprise Linux 4 | nss-tools | 0:3.12.2.0-3.el4 |
| Red Hat Enterprise Linux 4 | seamonkey | 0:1.0.9-35.el4 |
| Red Hat Enterprise Linux 4 | seamonkey-chat | 0:1.0.9-35.el4 |
| Red Hat Enterprise Linux 4 | seamonkey-debuginfo | 0:1.0.9-35.el4 |
| Red Hat Enterprise Linux 4 | seamonkey-devel | 0:1.0.9-35.el4 |
| Red Hat Enterprise Linux 4 | seamonkey-dom-inspector | 0:1.0.9-35.el4 |
| Red Hat Enterprise Linux 4 | seamonkey-js-debugger | 0:1.0.9-35.el4 |
| Red Hat Enterprise Linux 4 | seamonkey-mail | 0:1.0.9-35.el4 |
| Red Hat Enterprise Linux 5 | firefox | 0:3.0.6-1.el5 |
| Red Hat Enterprise Linux 5 | firefox-debuginfo | 0:3.0.6-1.el5 |
| Red Hat Enterprise Linux 5 | nss | 0:3.12.2.0-4.el5 |
| Red Hat Enterprise Linux 5 | nss-debuginfo | 0:3.12.2.0-4.el5 |
| Red Hat Enterprise Linux 5 | nss-devel | 0:3.12.2.0-4.el5 |
| Red Hat Enterprise Linux 5 | nss-pkcs11-devel | 0:3.12.2.0-4.el5 |
| Red Hat Enterprise Linux 5 | nss-tools | 0:3.12.2.0-4.el5 |
| Red Hat Enterprise Linux 5 | xulrunner | 0:1.9.0.6-1.el5 |
| Red Hat Enterprise Linux 5 | xulrunner-debuginfo | 0:1.9.0.6-1.el5 |
| Red Hat Enterprise Linux 5 | xulrunner-devel | 0:1.9.0.6-1.el5 |
| Red Hat Enterprise Linux 5 | xulrunner-devel-unstable | 0:1.9.0.6-1.el5 |
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |