4.3 - CVE-2009-3375

Executive Summary

Informations
Name	CVE-2009-3375	First vendor Publication	2009-10-29
Vendor	Cve	Last vendor Modification	2017-09-19

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score	4.3	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allows user-assisted remote attackers to bypass the Same Origin Policy and read an arbitrary content selection via the document.getSelection function.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3375

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-264	Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10440

Oval ID:	oval:org.mitre.oval:def:10440
Title:	content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allows user-assisted remote attackers to bypass the Same Origin Policy and read an arbitrary content selection via the document.getSelection function.
Description:	content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allows user-assisted remote attackers to bypass the Same Origin Policy and read an arbitrary content selection via the document.getSelection function.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3375	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section seamonkey-nspr is earlier than 0:1.0.9-0.47.el3 AND seamonkey-js-debugger is earlier than 0:1.0.9-0.47.el3 AND seamonkey-nss-devel is earlier than 0:1.0.9-0.47.el3 AND seamonkey is earlier than 0:1.0.9-0.47.el3 AND seamonkey-nspr-devel is earlier than 0:1.0.9-0.47.el3 AND seamonkey-mail is earlier than 0:1.0.9-0.47.el3 AND seamonkey-chat is earlier than 0:1.0.9-0.47.el3 AND seamonkey-devel is earlier than 0:1.0.9-0.47.el3 AND seamonkey-dom-inspector is earlier than 0:1.0.9-0.47.el3 AND seamonkey-nss is earlier than 0:1.0.9-0.47.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section nspr is earlier than 0:4.7.6-1.el4_8 AND seamonkey-js-debugger is earlier than 0:1.0.9-50.el4_8 AND nspr-devel is earlier than 0:4.7.6-1.el4_8 AND seamonkey is earlier than 0:1.0.9-50.el4_8 AND firefox is earlier than 0:3.0.15-3.el4 AND seamonkey-mail is earlier than 0:1.0.9-50.el4_8 AND seamonkey-chat is earlier than 0:1.0.9-50.el4_8 AND seamonkey-devel is earlier than 0:1.0.9-50.el4_8 AND seamonkey-dom-inspector is earlier than 0:1.0.9-50.el4_8 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section xulrunner-devel-unstable is earlier than 0:1.9.0.15-3.el5_4 AND xulrunner-devel is earlier than 0:1.9.0.15-3.el5_4 AND nspr is earlier than 0:4.7.6-1.el5_4 AND firefox is earlier than 0:3.0.15-3.el5_4 AND nspr-devel is earlier than 0:4.7.6-1.el5_4 AND xulrunner is earlier than 0:1.9.0.15-3.el5_4

Definition Id: oval:org.mitre.oval:def:5935

Oval ID:	oval:org.mitre.oval:def:5935
Title:	Remote bypass vulnerability in content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 via the document.getSelection function
Description:	content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 allows user-assisted remote attackers to bypass the Same Origin Policy and read an arbitrary content selection via the document.getSelection function.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2009-3375	Version:	9
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows 7	Product(s):	Mozilla Firefox
Definition Synopsis:
Mozilla Firefox Mainline release is installed AND Check for vulnerable version Mozilla Firefox Mainline version is 3.0.x to 3.0.14 AND Mozilla Firefox Mainline version is 3.5.x to 3.5.3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mozilla Firefox cpe:2.3:a:mozilla:firefox:3.5.3:::::::* cpe:2.3:a:mozilla:firefox:3.5.2:::::::* cpe:2.3:a:mozilla:firefox:3.5.1:::::::* cpe:2.3:a:mozilla:firefox:3.5:::::::* cpe:2.3:a:mozilla:firefox:3.0.9:::::::* cpe:2.3:a:mozilla:firefox:3.0.8:::::::* cpe:2.3:a:mozilla:firefox:3.0.7:::::::* cpe:2.3:a:mozilla:firefox:3.0.6:::::::* cpe:2.3:a:mozilla:firefox:3.0.5:::::::* cpe:2.3:a:mozilla:firefox:3.0.4:::::::* cpe:2.3:a:mozilla:firefox:3.0.3:::::::* cpe:2.3:a:mozilla:firefox:3.0.2:::::::* cpe:2.3:a:mozilla:firefox:3.0.13:::::::* cpe:2.3:a:mozilla:firefox:3.0.12:::::::* cpe:2.3:a:mozilla:firefox:3.0.11:::::::* cpe:2.3:a:mozilla:firefox:3.0.10:::::::* cpe:2.3:a:mozilla:firefox:3.0.1:::::::* cpe:2.3:a:mozilla:firefox:3.0:-:::::: cpe:2.3:a:mozilla:firefox:3.0:alpha:::::: cpe:2.3:a:mozilla:firefox:3.0:beta5:::::: cpe:2.3:a:mozilla:firefox:3.0:beta2::::::	21

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for firefox CESA-2009:1530 centos4 i386 File : nvt/gb_CESA-2009_1530_firefox_centos4_i386.nasl
2011-08-09	Name : CentOS Update for seamonkey CESA-2009:1531 centos3 i386 File : nvt/gb_CESA-2009_1531_seamonkey_centos3_i386.nasl
2011-08-09	Name : CentOS Update for seamonkey CESA-2009:1531 centos4 i386 File : nvt/gb_CESA-2009_1531_seamonkey_centos4_i386.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:290-1 (firefox) File : nvt/mdksa_2009_290_1.nasl
2009-11-23	Name : Ubuntu USN-853-1 (xulrunner-1.9.1) File : nvt/ubuntu_853_1.nasl
2009-11-11	Name : RedHat Security Advisory RHSA-2009:1531 File : nvt/RHSA_2009_1531.nasl
2009-11-11	Name : SuSE Security Advisory SUSE-SA:2009:052 (MozillaFirefox) File : nvt/suse_sa_2009_052.nasl
2009-11-11	Name : SLES11: Security update for Mozilla XULRunner File : nvt/sles11_mozilla-xulrunn1.nasl
2009-11-11	Name : SLES11: Security update for Mozilla Firefox File : nvt/sles11_MozillaFirefox7.nasl
2009-11-11	Name : SLES10: Security update for Mozilla XULRunner File : nvt/sles10_mozilla-xulrunn0.nasl
2009-11-11	Name : SLES10: Security update for Mozilla Firefox File : nvt/sles10_MozillaFirefox7.nasl
2009-11-11	Name : CentOS Security Advisory CESA-2009:1531 (seamonkey) File : nvt/ovcesa2009_1531.nasl
2009-11-11	Name : CentOS Security Advisory CESA-2009:1530 (firefox) File : nvt/ovcesa2009_1530.nasl
2009-11-11	Name : Mandriva Security Advisory MDVSA-2009:290 (firefox) File : nvt/mdksa_2009_290.nasl
2009-11-11	Name : FreeBSD Ports: firefox File : nvt/freebsd_firefox42.nasl
2009-11-11	Name : Fedora Core 10 FEDORA-2009-10981 (blam) File : nvt/fcore_2009_10981.nasl
2009-11-11	Name : Fedora Core 11 FEDORA-2009-10878 (chmsee) File : nvt/fcore_2009_10878.nasl
2009-11-11	Name : Debian Security Advisory DSA 1922-1 (xulrunner) File : nvt/deb_1922_1.nasl
2009-11-11	Name : RedHat Security Advisory RHSA-2009:1530 File : nvt/RHSA_2009_1530.nasl
2009-11-02	Name : Mozilla Firefox Multiple Vulnerabilities Nov-09 (Win) File : nvt/gb_firefox_mult_vuln_nov09_win.nasl
2009-11-02	Name : Mozilla Firefox Multiple Vulnerabilities Nov-09 (Linux) File : nvt/gb_firefox_mult_vuln_nov09_lin.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
59390	Mozilla Firefox document.getSelection Function Cross-origin Data Disclosure

Nessus® Vulnerability Scanner

Date	Description
2016-03-08	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0001_remote.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1530.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1531.nasl - Type : ACT_GATHER_INFO
2013-01-08	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20091027_seamonkey_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20091027_firefox_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-10-11	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mozilla-xulrunner190-6617.nasl - Type : ACT_GATHER_INFO
2010-10-11	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_MozillaFirefox-6609.nasl - Type : ACT_GATHER_INFO
2010-07-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-294.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1922.nasl - Type : ACT_GATHER_INFO
2010-01-08	Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0001.nasl - Type : ACT_GATHER_INFO
2009-12-04	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-290.nasl - Type : ACT_GATHER_INFO
2009-11-12	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-853-2.nasl - Type : ACT_GATHER_INFO
2009-11-05	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-10981.nasl - Type : ACT_GATHER_INFO
2009-11-05	Name : The remote openSUSE host is missing a security update. File : suse_11_1_MozillaFirefox-091102.nasl - Type : ACT_GATHER_INFO
2009-11-05	Name : The remote openSUSE host is missing a security update. File : suse_11_0_MozillaFirefox-091103.nasl - Type : ACT_GATHER_INFO
2009-11-04	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_mozilla-xulrunner190-6616.nasl - Type : ACT_GATHER_INFO
2009-11-04	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_MozillaFirefox-091030.nasl - Type : ACT_GATHER_INFO
2009-11-04	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_mozilla-xulrunner190-091030.nasl - Type : ACT_GATHER_INFO
2009-11-04	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_MozillaFirefox-6606.nasl - Type : ACT_GATHER_INFO
2009-11-02	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-853-1.nasl - Type : ACT_GATHER_INFO
2009-10-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1531.nasl - Type : ACT_GATHER_INFO
2009-10-29	Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_354.nasl - Type : ACT_GATHER_INFO
2009-10-29	Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_3015.nasl - Type : ACT_GATHER_INFO
2009-10-29	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_c87aa2d2c3c411deab08000f20797ede.nasl - Type : ACT_GATHER_INFO
2009-10-29	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-10878.nasl - Type : ACT_GATHER_INFO
2009-10-29	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1530.nasl - Type : ACT_GATHER_INFO
2009-10-28	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1531.nasl - Type : ACT_GATHER_INFO
2009-10-28	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1530.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
CONFIRM	http://www.mozilla.org/security/announce/2009/mfsa2009-61.html https://bugzilla.mozilla.org/show_bug.cgi?id=503226
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:294
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
SUNALERT	http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1
VUPEN	http://www.vupen.com/english/advisories/2009/3334

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-02-02 01:11:41	Multiple Updates
2024-02-01 12:03:16	Multiple Updates
2023-09-05 12:10:56	Multiple Updates
2023-09-05 01:03:07	Multiple Updates
2023-09-02 12:11:02	Multiple Updates
2023-09-02 01:03:08	Multiple Updates
2023-08-12 12:12:58	Multiple Updates
2023-08-12 01:03:07	Multiple Updates
2023-08-11 12:11:03	Multiple Updates
2023-08-11 01:03:15	Multiple Updates
2023-08-06 12:10:39	Multiple Updates
2023-08-06 01:03:09	Multiple Updates
2023-08-04 12:10:44	Multiple Updates
2023-08-04 01:03:11	Multiple Updates
2023-07-14 12:10:41	Multiple Updates
2023-07-14 01:03:09	Multiple Updates
2023-03-29 01:12:13	Multiple Updates
2023-03-28 12:03:15	Multiple Updates
2022-10-11 12:09:31	Multiple Updates
2022-10-11 01:02:58	Multiple Updates
2021-05-04 12:10:14	Multiple Updates
2021-04-22 01:10:39	Multiple Updates
2020-05-23 00:24:22	Multiple Updates
2017-09-19 09:23:25	Multiple Updates
2016-04-26 19:08:57	Multiple Updates
2016-03-09 13:25:54	Multiple Updates
2014-02-17 10:51:44	Multiple Updates
2013-07-15 17:18:36	Multiple Updates
2013-05-10 23:57:59	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	2
CPE ID(s)	21
Sources(s)	7
osvdb(s)	1
Openvas Exploit(s)	21
Nessus® Exploit(s)	29

	Related
10	VMSA-2010-0001
10	USN-853-2
10	USN-853-1
10	SUN-272909
10	RHSA-2009:1531
10	RHSA-2009:1530
10	MDVSA-2009:294
10	MDVSA-2009:290-1
10	MDVSA-2009:290
10	GLSA-201301-01
10	DSA-1922
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 11 more Alert(s)

4.3 - CVE-2009-3375

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU