CVE-2009-3988
Fixed in a distro release EPSS 2%
Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.
Products: mozilla firefox, mozilla seamonkey
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 5.0 | xulrunner | 1.9.0.18-1 |
| Red Hat Enterprise Linux 4 | firefox | 0:3.0.18-1.el4 |
| Red Hat Enterprise Linux 4 | firefox-debuginfo | 0:3.0.18-1.el4 |
| Red Hat Enterprise Linux 5 | firefox | 0:3.0.18-1.el5_4 |
| Red Hat Enterprise Linux 5 | firefox-debuginfo | 0:3.0.18-1.el5_4 |
| Red Hat Enterprise Linux 5 | xulrunner | 0:1.9.0.18-1.el5_4 |
| Red Hat Enterprise Linux 5 | xulrunner-debuginfo | 0:1.9.0.18-1.el5_4 |
| Red Hat Enterprise Linux 5 | xulrunner-devel | 0:1.9.0.18-1.el5_4 |
| Red Hat Enterprise Linux 5 | xulrunner-devel-unstable | 0:1.9.0.18-1.el5_4 |