Published: 04/02/2009 Updated: 29/09/2017

CVSS v2 Base Score: 3.3 | Impact Score: 2.9 | Exploitability Score: 6.5

VMScore: 294

Vector: AV:A/AC:L/Au:N/C:P/I:N/A:N

Mozilla Firefox 3.x prior to 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox 3.0
mozilla firefox 3.0.1
mozilla firefox 3.0.2
mozilla firefox 3.0.3
mozilla firefox 3.0.4
mozilla firefox 3.0.5

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An updated firefox package that fixes various security issues is nowavailable for Red Hat Enterprise Linux 4 and 5This update has been rated as having critical security impact by the RedHat Security Response Team ...

Several flaws were discovered in the browser engine These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges (CVE-2009-0352, CVE-2009-0353) ...

Mozilla Foundation Security Advisory 2009-06 Directives to not cache pages ignored Announced February 3, 2009 Reporter Paul Nel Impact Low Products Firefox Fixed in Firefox 306 ...

CWE-200 http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspx http://www.securityfocus.com/bid/33598 http://www.mozilla.org/security/announce/2009/mfsa2009-06.html https://bugzilla.mozilla.org/show_bug.cgi?id=441751 http://secunia.com/advisories/33809 http://rhn.redhat.com/errata/RHSA-2009-0256.html http://www.securitytracker.com/id?1021667 http://secunia.com/advisories/33799 http://www.ubuntu.com/usn/usn-717-1 http://secunia.com/advisories/33869 http://www.mandriva.com/security/advisories?name=MDVSA-2009:044 http://secunia.com/advisories/33831 http://secunia.com/advisories/33841 http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html http://secunia.com/advisories/33846 http://www.vupen.com/english/advisories/2009/0313 http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10610 https://access.redhat.com/errata/RHSA-2009:0256 https://usn.ubuntu.com/717-1/https://nvd.nist.gov

CVE-2009-0358

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect