Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-2472 | First vendor Publication | 2009-07-22 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2472 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13773 | |||
| Oval ID: | oval:org.mitre.oval:def:13773 | ||
| Title: | DSA-1840-1 xulrunner -- several vulnerabilities | ||
| Description: | Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2462 Martijn Wargers, Arno Renevier, Jesse Ruderman, Olli Pettay and Blake Kaplan disocvered several issues in the browser engine that could potentially lead to the execution of arbitrary code. CVE-2009-2463 monarch2020 reported an integer overflow in a base64 decoding function. CVE-2009-2464 Christophe Charron reported a possibly exploitable crash occuring when multiple RDF files were loaded in a XUL tree element. CVE-2009-2465 Yongqian Li reported that an unsafe memory condition could be created by specially crafted document. CVE-2009-2466 Peter Van der Beken, Mike Shaver, Jesse Ruderman, and Carsten Book discovered several issues in the JavaScript engine that could possibly lead to the execution of arbitrary JavaScript. CVE-2009-2467 Attila Suszter discovered an issue related to a specially crafted Flash object, which could be used to run arbitrary code. CVE-2009-2469 PenPal discovered that it is possible to execute arbitrary code via a specially crafted SVG element. CVE-2009-2471 Blake Kaplan discovered a flaw in the JavaScript engine that might allow an attacker to execute arbitrary JavaScript with chrome privileges. CVE-2009-2472 moz_bug_r_a4 discovered an issue in the JavaScript engine that could be used to perform cross-site scripting attacks. For the stable distribution, these problems have been fixed in version 1.9.0.12-0lenny1. As indicated in the Etch release notes, security support for the Mozilla products in the oldstable distribution needed to be stopped before the end of the regular Etch security maintenance life cycle. You are strongly encouraged to upgrade to stable or switch to a still supported browser. For the testing distribution, these problems will be fixed soon. For the unstable distribution, these problems have been fixed in version 1.9.0.12-1. We recommend that you upgrade your xulrunner packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1840-1 CVE-2009-2462 CVE-2009-2463 CVE-2009-2464 CVE-2009-2465 CVE-2009-2466 CVE-2009-2467 CVE-2009-2469 CVE-2009-2471 CVE-2009-2472 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | xulrunner |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7832 | |||
| Oval ID: | oval:org.mitre.oval:def:7832 | ||
| Title: | DSA-1840 xulrunner -- several vulnerabilities | ||
| Description: | Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems: Martijn Wargers, Arno Renevier, Jesse Ruderman, Olli Pettay and Blake Kaplan discovered several issues in the browser engine that could potentially lead to the execution of arbitrary code. (MFSA 2009-34) monarch2020 reported an integer overflow in a base64 decoding function. (MFSA 2009-34) Christophe Charron reported a possibly exploitable crash occuring when multiple RDF files were loaded in a XUL tree element. (MFSA 2009-34) Yongqian Li reported that an unsafe memory condition could be created by specially crafted document. (MFSA 2009-34) Peter Van der Beken, Mike Shaver, Jesse Ruderman, and Carsten Book discovered several issues in the JavaScript engine that could possibly lead to the execution of arbitrary JavaScript. (MFSA 2009-34) Attila Suszter discovered an issue related to a specially crafted Flash object, which could be used to run arbitrary code. (MFSA 2009-35) PenPal discovered that it is possible to execute arbitrary code via a specially crafted SVG element. (MFSA 2009-37) Blake Kaplan discovered a flaw in the JavaScript engine that might allow an attacker to execute arbitrary JavaScript with chrome privileges. (MFSA 2009-39) moz_bug_r_a4 discovered an issue in the JavaScript engine that could be used to perform cross-site scripting attacks. (MFSA 2009-40) | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1840 CVE-2009-2462 CVE-2009-2463 CVE-2009-2464 CVE-2009-2465 CVE-2009-2466 CVE-2009-2467 CVE-2009-2469 CVE-2009-2471 CVE-2009-2472 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | xulrunner |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9497 | |||
| Oval ID: | oval:org.mitre.oval:def:9497 | ||
| Title: | Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass." | ||
| Description: | Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass." | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-2472 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for firefox CESA-2009:1162 centos5 i386 File : nvt/gb_CESA-2009_1162_firefox_centos5_i386.nasl |
| 2009-10-11 | Name : SLES11: Security update for MozillaFirefox File : nvt/sles11_MozillaFirefox4.nasl |
| 2009-08-17 | Name : Mandrake Security Advisory MDVSA-2009:182 (firefox) File : nvt/mdksa_2009_182.nasl |
| 2009-08-17 | Name : Mandrake Security Advisory MDVSA-2009:185 (firefox) File : nvt/mdksa_2009_185.nasl |
| 2009-07-29 | Name : RedHat Security Advisory RHSA-2009:1162 File : nvt/RHSA_2009_1162.nasl |
| 2009-07-29 | Name : Debian Security Advisory DSA 1840-1 (xulrunner) File : nvt/deb_1840_1.nasl |
| 2009-07-29 | Name : Fedora Core 10 FEDORA-2009-7961 (blam) File : nvt/fcore_2009_7961.nasl |
| 2009-07-29 | Name : CentOS Security Advisory CESA-2009:1162 (firefox) File : nvt/ovcesa2009_1162.nasl |
| 2009-07-29 | Name : SuSE Security Advisory SUSE-SA:2009:039 (MozillaFirefox) File : nvt/suse_sa_2009_039.nasl |
| 2009-07-29 | Name : Ubuntu USN-798-1 (xulrunner-1.9) File : nvt/ubuntu_798_1.nasl |
| 2009-07-29 | Name : Ubuntu USN-805-1 (ruby1.9) File : nvt/ubuntu_805_1.nasl |
| 2009-07-23 | Name : Mozilla Firefox Multiple Vulnerabilities July-09 (Linux) File : nvt/secpod_firefox_mult_vuln_jul09_lin.nasl |
| 2009-07-23 | Name : Mozilla Firefox Multiple Vulnerabilities July-09 (Win) File : nvt/secpod_firefox_mult_vuln_jul09_win.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 56232 | Mozilla Firefox Multiple Method XPCCrossOriginWrapper Bypass |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1162.nasl - Type : ACT_GATHER_INFO |
| 2013-01-08 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO |
| 2012-11-05 | Name : The remote Scientific Linux host is missing a security update. File : sl_20090722_firefox_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20090723_firefox_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20090723_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1840.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1162.nasl - Type : ACT_GATHER_INFO |
| 2009-10-06 | Name : The remote openSUSE host is missing a security update. File : suse_MozillaFirefox-6379.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_MozillaFirefox-090724.nasl - Type : ACT_GATHER_INFO |
| 2009-07-31 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-182.nasl - Type : ACT_GATHER_INFO |
| 2009-07-28 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_MozillaFirefox-090724.nasl - Type : ACT_GATHER_INFO |
| 2009-07-28 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_MozillaFirefox-090724.nasl - Type : ACT_GATHER_INFO |
| 2009-07-24 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-7961.nasl - Type : ACT_GATHER_INFO |
| 2009-07-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-798-1.nasl - Type : ACT_GATHER_INFO |
| 2009-07-22 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_3012.nasl - Type : ACT_GATHER_INFO |
| 2009-07-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1162.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:10:48 |
|
| 2024-11-28 12:19:25 |
|
| 2024-11-01 01:12:07 |
|
| 2024-10-22 12:12:05 |
|
| 2024-08-02 12:11:52 |
|
| 2024-08-02 01:03:12 |
|
| 2024-02-10 01:10:49 |
|
| 2024-02-02 01:11:22 |
|
| 2024-02-01 12:03:10 |
|
| 2023-09-05 12:10:37 |
|
| 2023-09-05 01:03:01 |
|
| 2023-09-02 12:10:44 |
|
| 2023-09-02 01:03:02 |
|
| 2023-08-12 12:12:36 |
|
| 2023-08-12 01:03:01 |
|
| 2023-08-11 12:10:45 |
|
| 2023-08-11 01:03:09 |
|
| 2023-08-06 12:10:21 |
|
| 2023-08-06 01:03:03 |
|
| 2023-08-04 12:10:26 |
|
| 2023-08-04 01:03:05 |
|
| 2023-07-14 12:10:23 |
|
| 2023-07-14 01:03:03 |
|
| 2023-03-29 01:11:52 |
|
| 2023-03-28 12:03:09 |
|
| 2022-10-11 12:09:15 |
|
| 2022-10-11 01:02:52 |
|
| 2021-07-29 17:24:28 |
|
| 2021-05-04 12:09:49 |
|
| 2021-04-22 01:10:10 |
|
| 2020-10-14 01:04:41 |
|
| 2020-10-03 01:04:39 |
|
| 2020-05-29 01:04:16 |
|
| 2020-05-23 01:40:38 |
|
| 2020-05-23 00:24:02 |
|
| 2017-11-22 12:03:03 |
|
| 2017-09-19 09:23:17 |
|
| 2016-04-26 18:58:29 |
|
| 2014-02-17 10:50:46 |
|
| 2013-05-10 23:53:57 |
|
