FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-1312

This CVE name corresponds to:

Entered Topic
2009-04-22 mozilla -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2009-1312
Phase Assigned(20090416)

Description

Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.

References

Source Reference
BUGTRAQ 20090702 Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome
BUGTRAQ 20090703 Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome
MISC http://ha.ckers.org/blog/20070309/firefox-header-redirection-javascript-execution/
MISC http://websecurity.com.ua/3275/
MISC http://websecurity.com.ua/3386/
CONFIRM http://www.mozilla.org/security/announce/2009/mfsa2009-22.html
CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=475636
FEDORA FEDORA-2009-3875
MANDRIVA MDVSA-2009:111
REDHAT RHSA-2009:0436
REDHAT RHSA-2009:0437
SUNALERT 264308
SUSE SUSE-SR:2009:010
UBUNTU USN-764-1
BID 34656
OVAL oval:org.mitre.oval:def:6064
OVAL oval:org.mitre.oval:def:6131
OVAL oval:org.mitre.oval:def:6731
OVAL oval:org.mitre.oval:def:9818
SECTRACK 1022096
SECUNIA 34758
SECUNIA 34894
SECUNIA 34843
SECUNIA 34844
SECUNIA 35065
VUPEN ADV-2009-1125