CVE-2009-3985

NameCVE-2009-3985
DescriptionMozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-1956-1
NVD severitymedium (attack range: remote)
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
iceweasel (PTS)squeeze (security), squeeze3.5.16-20fixed
wheezy31.3.0esr-1~deb7u1fixed
wheezy (security)31.6.0esr-1~deb7u1fixed
jessie, sid31.6.0esr-1fixed
xulrunner (PTS)wheezy, wheezy (security)24.8.1esr-2~deb7u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceweaselsource(unstable)3.5.11-2medium
iceweaselsourcelenny(not affected)
xulrunnersource(unstable)1.9.1.6-1medium
xulrunnersourceetch(unfixed)end-of-life
xulrunnersourcelenny1.9.0.16-1mediumDSA-1956-1

Notes

[lenny] - iceweasel <not-affected> (Iceweasel in Lenny links against xulrunner)
[etch] - xulrunner <end-of-life> (Etch Packages no longer covered by security support)

Search for package or bug name: Reporting problems