Red Hat Security Advisory

RHSA-2009:0436

firefox security update

Released 2009-04-22 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-3.0.9-1.el5, firefox-3.0.9-1.el5.i386, firefox-3.0.9-1.el5.ia64 +13
Red Hat Enterprise Linux AS version 4 firefox-3.0.9-1.el4, firefox-3.0.9-1.el4.i386, firefox-3.0.9-1.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.0.9-1.el5, firefox-3.0.9-1.el5.i386, xulrunner-1.9.0.9-1.el5 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xulrunner-1.9.0.9-1.el5, xulrunner-devel-1.9.0.9-1.el5, xulrunner-devel-1.9.0.9-1.el5.i386 +2
Red Hat Enterprise Linux Desktop version 4 firefox-3.0.9-1.el4, firefox-3.0.9-1.el4.i386
Red Hat Enterprise Linux ES version 4 firefox-3.0.9-1.el4, firefox-3.0.9-1.el4.i386, firefox-3.0.9-1.el4.ia64
Red Hat Enterprise Linux WS version 4 firefox-3.0.9-1.el4, firefox-3.0.9-1.el4.i386, firefox-3.0.9-1.el4.ia64

Fixes 12 records

TI-2009-01242 CVE-2009-1307 · GHSA-5cxh-4rwm-2jh3

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and…

LOW 34

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02183 Published 2009-04-22 Fixed CWE-20

TI-2009-01247 CVE-2009-1312 · GHSA-3mmx-h8fr-v7j4

Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in…

LOW 29

Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1)…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05565 Published 2009-04-22 Fixed CWE-16

TI-2009-00628 CVE-2009-0652 · GHSA-h8qx-x78q-837g

The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other…

LOW 29

The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01497 Published 2009-02-20 Fixed

TI-2009-01237 CVE-2009-1302 · GHSA-r98g-pww2-x9wj

The browser engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and…

LOW 28

The browser engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corrup…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.029 Published 2009-04-22 Fixed CWE-399

TI-2009-01240 CVE-2009-1305 · GHSA-275w-m9g6-w2cc

The JavaScript engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and…

LOW 27

The JavaScript engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corrupt…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01947 Published 2009-04-22 Fixed CWE-399

TI-2009-01239 CVE-2009-1304 · GHSA-62pj-m994-qpwg

The JavaScript engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22…

LOW 27

The JavaScript engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory cor…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.021 Published 2009-04-22 Fixed CWE-399

TI-2009-01238 CVE-2009-1303 · GHSA-g69g-mf2j-vrwq

The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and…

LOW 26

The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (application crash) and possibly trigger memory corruption…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01761 Published 2009-04-22 Fixed CWE-16

TI-2009-01246 CVE-2009-1311 · GHSA-6jvr-wqq8-f5hr

Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote…

LOW 25

Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote attackers to obtain sensitive information via a web page with an embedded frame, which causes POST data from an outer page to be sent to…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02313 Published 2009-04-22 Fixed CWE-200

TI-2009-01243 CVE-2009-1308 · GHSA-chqp-7f63-6c5w

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird…

LOW 24

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02288 Published 2009-04-22 Fixed CWE-79

TI-2009-01245 CVE-2009-1310 · GHSA-5cmh-2qjc-74gp

Cross-site scripting (XSS) vulnerability in the MozSearch plugin implementation in…

LOW 23

Cross-site scripting (XSS) vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote attackers to inject arbitrary web script or HTML via a javascript: URI in the Se…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0151 Published 2009-04-22 Fixed CWE-79

TI-2009-01244 CVE-2009-1309 · GHSA-g3r3-3vcq-q6hc

Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the…

LOW 23

Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involv…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01351 Published 2009-04-22 Fixed CWE-16

TI-2009-01241 CVE-2009-1306 · GHSA-hh3w-x3wq-8jvq

The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey…

LOW 23

The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting (XSS)…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01329 Published 2009-04-22 Fixed CWE-16