Red Hat Security AdvisoryRHSA-2009:0256
firefox security update
Released 2009-02-04 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) firefox-3.0.6-1.el5, firefox-3.0.6-1.el5.i386, firefox-3.0.6-1.el5.ia64 +29
- Red Hat Enterprise Linux AS version 4 firefox-3.0.6-1.el4, firefox-3.0.6-1.el4.i386, firefox-3.0.6-1.el4.ia64 +13
- Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.0.6-1.el5, firefox-3.0.6-1.el5.i386, nss-3.12.2.0-4.el5 +5
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nss-3.12.2.0-4.el5, nss-devel-3.12.2.0-4.el5, nss-devel-3.12.2.0-4.el5.i386 +7
- Red Hat Enterprise Linux Desktop version 4 firefox-3.0.6-1.el4, firefox-3.0.6-1.el4.i386, nss-3.12.2.0-3.el4 +5
- Red Hat Enterprise Linux ES version 4 firefox-3.0.6-1.el4, firefox-3.0.6-1.el4.i386, firefox-3.0.6-1.el4.ia64 +9
- Red Hat Enterprise Linux WS version 4 firefox-3.0.6-1.el4, firefox-3.0.6-1.el4.i386, firefox-3.0.6-1.el4.ia64 +9
Fixes 7 records
Priority MEDIUM 50
Unspecified vulnerability in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to cause a denial of service (memory corruption and application crash) or po…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.04331 · Published 2009-02-04 · Fixed CWE-399
Priority MEDIUM 50
Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allow remote attackers to cause a denial of service (memory corruption and application cr…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.04331 · Published 2009-02-04 · Fixed CWE-399
Priority LOW 29
Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execu…
CVSS 2.0MEDIUM 5.1· Network · No auth · Interaction — · EPSS 0.03225 · Published 2009-02-04 · Fixed CWE-59
Priority LOW 28
components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary…
CVSS 2.0MEDIUM 5.4· Network · No auth · Interaction — · EPSS 0.01635 · Published 2009-02-04 · Fixed CWE-264
Priority LOW 26
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive i…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.0156 · Published 2009-02-04 · Fixed CWE-264
Priority LOW 18
Cross-domain vulnerability in js/src/jsobj.cpp in Mozilla Firefox 3.x before 3.0.6 allows remote attackers to bypass the Same Origin Policy, and access the properties of an arbitrary window and conduct cross-site scripti…
CVSS 2.0LOW 2.6· Network · No auth · Interaction — · EPSS 0.02323 · Published 2009-02-04 · Fixed CWE-79
Priority LOW 17
Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) histor…
CVSS 2.0LOW 3.3· Adjacent network · No auth · Interaction — · EPSS 0.00521 · Published 2009-02-04 · Fixed CWE-200
THREATIST.IORead the docs