Published: 04/08/2009 Updated: 04/09/2009

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The nsDocument::SetScriptGlobalObject function in content/base/src/nsDocument.cpp in Mozilla Firefox 3.5.x prior to 3.5.2, when certain add-ons are enabled, does not properly handle a Link HTTP header, which allows remote malicious users to execute arbitrary JavaScript with chrome privileges via a crafted web page, related to an incorrect security wrapper.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox 3.5
mozilla firefox 3.5.1
mozilla firefox 3.5.2

Mozilla Foundation Security Advisory 2009-46 Chrome privilege escalation due to incorrectly cached wrapper Announced August 3, 2009 Reporter Wladimir Palant, moz_bug_r_a4 Impact Critical Products Firefox Fixed in ...

CWE-94 https://bugzilla.mozilla.org/show_bug.cgi?id=498897 http://www.mozilla.org/security/announce/2009/mfsa2009-46.html http://www.vupen.com/english/advisories/2009/2142 http://secunia.com/advisories/36126 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00198.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00261.html http://www.securityfocus.com/bid/35928 http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1 https://nvd.nist.gov https://www.mozilla.org/en-US/security/advisories/mfsa2009-46/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-2665

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect