FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-1309

This CVE name corresponds to:

Entered Topic
2009-04-22 mozilla -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2009-1309
Phase Assigned(20090416)

Description

Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involving an incorrect __proto__ scope, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via a crafted document.

References

Source Reference
CONFIRM http://www.mozilla.org/security/announce/2009/mfsa2009-19.html
CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=478433
CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=482206
DEBIAN DSA-1797
FEDORA FEDORA-2009-3875
MANDRIVA MDVSA-2009:111
MANDRIVA MDVSA-2009:141
REDHAT RHSA-2009:0436
REDHAT RHSA-2009:0437
REDHAT RHSA-2009:1125
REDHAT RHSA-2009:1126
SUNALERT 264308
SUSE SUSE-SR:2009:010
UBUNTU USN-764-1
UBUNTU USN-782-1
BID 34656
OVAL oval:org.mitre.oval:def:5265
OVAL oval:org.mitre.oval:def:5591
OVAL oval:org.mitre.oval:def:6139
OVAL oval:org.mitre.oval:def:6831
OVAL oval:org.mitre.oval:def:9494
SECTRACK 1022094
SECUNIA 34758
SECUNIA 34894
SECUNIA 34843
SECUNIA 34844
SECUNIA 34780
SECUNIA 35065
SECUNIA 35042
SECUNIA 35536
VUPEN ADV-2009-1125