CVE-2009-3985

NameCVE-2009-3985
DescriptionMozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1956-1
NVD severitymedium (attack range: remote)

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceweaselsource(unstable)3.5.11-2medium
iceweaselsourcelenny(not affected)
xulrunnersource(unstable)1.9.1.6-1medium
xulrunnersourceetch(unfixed)end-of-life
xulrunnersourcelenny1.9.0.16-1mediumDSA-1956-1

Notes

[lenny] - iceweasel <not-affected> (Iceweasel in Lenny links against xulrunner)
[etch] - xulrunner <end-of-life> (Etch Packages no longer covered by security support)

Search for package or bug name: Reporting problems