FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-1839

This CVE name corresponds to:

Entered	Topic
2009-06-12	mozilla -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-1839 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-1839
Phase	Assigned(20090529)

Description

Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded through the location bar, which allows user-assisted remote attackers to bypass intended access restrictions and read files via a crafted HTML document, aka a "file-URL-to-file-URL scripting" attack.

References

Source	Reference
CONFIRM	http://www.mozilla.org/security/announce/2009/mfsa2009-30.html
CONFIRM	https://bugzilla.mozilla.org/show_bug.cgi?id=479943
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=503581
DEBIAN	DSA-1820
FEDORA	FEDORA-2009-6366
FEDORA	FEDORA-2009-6411
REDHAT	RHSA-2009:1095
SLACKWARE	SSA:2009-167-01
SUNALERT	264308
BID	35326
BID	35386
OSVDB	55163
OVAL	oval:org.mitre.oval:def:9256
SECUNIA	35331
SECUNIA	35431
SECUNIA	35468
SECUNIA	35415
VUPEN	ADV-2009-1572