CVE-2009-3385
Fixed in a distro release EPSS 3%
The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation.
Products: mozilla seamonkey
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 5.0 | xulrunner | 1.9.0.15-0lenny1 |
| Red Hat Enterprise Linux 3 | seamonkey | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-chat | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-debuginfo | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-devel | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-dom-inspector | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-js-debugger | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-mail | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nspr | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nspr-devel | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nss | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nss-devel | 0:1.0.9-0.47.el3 |
| Red Hat Enterprise Linux 4 | seamonkey | 0:1.0.9-50.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-chat | 0:1.0.9-50.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-debuginfo | 0:1.0.9-50.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-devel | 0:1.0.9-50.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-dom-inspector | 0:1.0.9-50.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-js-debugger | 0:1.0.9-50.el4_8 |
| Red Hat Enterprise Linux 4 | seamonkey-mail | 0:1.0.9-50.el4_8 |