CVE-2009-3988

NameCVE-2009-3988
DescriptionMozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1999-1
NVD severitymedium (attack range: remote)

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceapesource(unstable)2.0.3-1medium
iceapesourcelenny(not affected)
iceweaselsource(unstable)3.5.11-2medium
iceweaselsourcelenny(not affected)
xulrunnersource(unstable)1.9.1.8-1medium
xulrunnersourceetch(unfixed)end-of-life
xulrunnersourcelenny1.9.0.18-1mediumDSA-1999-1

Notes

[lenny] - iceweasel <not-affected> (Iceweasel in Lenny links against xulrunner)
[lenny] - iceape <not-affected> (Lenny package only provide xpcom stubs)

Search for package or bug name: Reporting problems