CVE-2009-1840

Loading...

General

Score:9.3/10.0
Severity:High
Category:Access Control Error
Exploit:Available

Impact Metrics

Confidentiality:Complete
Integrity:Complete
Availability:Complete

Exploitability Metrics

Access Vector:Network
Access Complexity:Medium
Authentication:None

Relative vulnerabilities

CVE-2009-1392, CVE-2009-1832, CVE-2009-1833, CVE-2009-1834, CVE-2009-1835, CVE-2009-1836, CVE-2009-1837, CVE-2009-1838, CVE-2009-1839, CVE-2009-1841

Published on 12/06/09 - Updated on 29/09/17

Description

Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy before loading a script file into a XUL document, which allows remote attackers to bypass intended access restrictions via a crafted HTML document, as demonstrated by a "web bug" in an e-mail message, or web script or an advertisement in a web page.

Category: Access Control Error

CWE-264 (Permissions, Privileges, and Access Control)
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Security Notices

US National Vulnerability DatabaseCVE-2009-1840
Agence Nationale de la Sécurité des Systèmes d'Information CERTA-2009-AVI-233, CERTA-2009-AVI-251
CentOS CESA-2009:1095
Mozilla MFSA2009-31
Redhat RHSA-2009:1095

Exploits

SecurityFocusBID-35326

Relative technologies

VendorProduct
mozillafirefox
mozillaseamonkey
mozillathunderbird

Share this vulnerability with:

Twitter Facebook LinkedIn Mail