1. CVE-Search
  2. CVE-2009-1312
ID CVE-2009-1312
Summary Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9_rc:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9_rc:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.6:*:linux:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.6:*:linux:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0:beta_1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0:beta_1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:2.0_8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0_8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0:-:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0:-:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.5:-:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.5:-:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0:-:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0:-:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:3.0beta5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:3.0beta5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 10-10-2018 - 19:35)
Impact:
Exploitability:
CWE CWE-16
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:P/A:N
oval via4
  • accepted 2009-07-06T04:00:36.308-04:00
    class vulnerability
    contributors
    • name Chandan S
      organization SecPod Technologies
    • name Brendan Miles
      organization The MITRE Corporation
    • name J. Daniel Brown
      organization DTCC
    • name Sergey Artykhov
      organization ALTX-SOFT
    • name Sergey Artykhov
      organization ALTX-SOFT
    definition_extensions
    • comment Microsoft Windows XP (x86) SP2 is installed
      oval oval:org.mitre.oval:def:754
    • comment Microsoft Windows XP (x86) SP3 is installed
      oval oval:org.mitre.oval:def:5631
    • comment Microsoft Windows Vista (32-bit) is installed
      oval oval:org.mitre.oval:def:1282
    • comment Microsoft Windows Vista (32-bit) Service Pack 1 is installed
      oval oval:org.mitre.oval:def:4873
    • comment Microsoft Windows Server 2003 SP1 (x86) is installed
      oval oval:org.mitre.oval:def:565
    • comment Microsoft Windows Server 2003 SP2 (x86) is installed
      oval oval:org.mitre.oval:def:1935
    description Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
    family windows
    id oval:org.mitre.oval:def:6064
    status deprecated
    submitted 2009-04-30T09:45:11
    title Mozilla Firefox XSS Vulnerability
    version 26
  • accepted 2009-07-06T04:00:37.982-04:00
    class vulnerability
    contributors
    • name Chandan S
      organization SecPod Technologies
    • name Brendan Miles
      organization The MITRE Corporation
    • name J. Daniel Brown
      organization DTCC
    • name Shane Shaffer
      organization G2, Inc.
    definition_extensions
    • comment Microsoft Windows XP (x86) SP2 is installed
      oval oval:org.mitre.oval:def:754
    • comment Microsoft Windows XP (x86) SP3 is installed
      oval oval:org.mitre.oval:def:5631
    • comment Microsoft Windows Vista (32-bit) is installed
      oval oval:org.mitre.oval:def:1282
    • comment Microsoft Windows Vista (32-bit) Service Pack 1 is installed
      oval oval:org.mitre.oval:def:4873
    • comment Microsoft Windows Server 2003 SP1 (x86) is installed
      oval oval:org.mitre.oval:def:565
    • comment Microsoft Windows Server 2003 SP2 (x86) is installed
      oval oval:org.mitre.oval:def:1935
    description Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
    family windows
    id oval:org.mitre.oval:def:6131
    status deprecated
    submitted 2009-04-30T09:45:11
    title Mozilla Seamonkey XSS Vulnerability
    version 26
  • accepted 2014-03-17T04:00:30.821-04:00
    class vulnerability
    contributors
    • name J. Daniel Brown
      organization DTCC
    • name Sergey Artykhov
      organization ALTX-SOFT
    • name Sergey Artykhov
      organization ALTX-SOFT
    • name Shane Shaffer
      organization G2, Inc.
    • name Maria Kedovskaya
      organization ALTX-SOFT
    • name Maria Mikhno
      organization ALTX-SOFT
    definition_extensions
    • comment Mozilla Seamonkey is installed
      oval oval:org.mitre.oval:def:6372
    • comment Mozilla Firefox Mainline release is installed
      oval oval:org.mitre.oval:def:22259
    description Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
    family windows
    id oval:org.mitre.oval:def:6731
    status accepted
    submitted 2009-12-26T17:00:00.000-05:00
    title Mozilla Firefox and Seamonkey XSS Vulnerability
    version 27
  • accepted 2013-04-29T04:22:30.469-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    • comment The operating system installed on the system is Red Hat Enterprise Linux 5
      oval oval:org.mitre.oval:def:11414
    • comment The operating system installed on the system is CentOS Linux 5.x
      oval oval:org.mitre.oval:def:15802
    • comment Oracle Linux 5.x
      oval oval:org.mitre.oval:def:15459
    description Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
    family unix
    id oval:org.mitre.oval:def:9818
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
    version 30
redhat via4
advisories
  • bugzilla
    id 496274
    title CVE-2009-1312 Firefox allows Refresh header to redirect to javascript: URIs
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304025
      • comment firefox is earlier than 0:3.0.9-1.el4
        oval oval:com.redhat.rhsa:tst:20090436001
      • comment firefox is signed with Red Hat master key
        oval oval:com.redhat.rhsa:tst:20060200002
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331005
      • OR
        • AND
          • comment xulrunner is earlier than 0:1.9.0.9-1.el5
            oval oval:com.redhat.rhsa:tst:20090436004
          • comment xulrunner is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20080569002
        • AND
          • comment xulrunner-devel is earlier than 0:1.9.0.9-1.el5
            oval oval:com.redhat.rhsa:tst:20090436006
          • comment xulrunner-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20080569004
        • AND
          • comment xulrunner-devel-unstable is earlier than 0:1.9.0.9-1.el5
            oval oval:com.redhat.rhsa:tst:20090436008
          • comment xulrunner-devel-unstable is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20080569006
        • AND
          • comment firefox is earlier than 0:3.0.9-1.el5
            oval oval:com.redhat.rhsa:tst:20090436010
          • comment firefox is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070097008
    rhsa
    id RHSA-2009:0436
    released 2009-04-22
    severity Critical
    title RHSA-2009:0436: firefox security update (Critical)
  • bugzilla
    id 496274
    title CVE-2009-1312 Firefox allows Refresh header to redirect to javascript: URIs
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304025
      • OR
        • AND
          • comment seamonkey is earlier than 0:1.0.9-41.el4
            oval oval:com.redhat.rhsa:tst:20090437001
          • comment seamonkey is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060609002
        • AND
          • comment seamonkey-chat is earlier than 0:1.0.9-41.el4
            oval oval:com.redhat.rhsa:tst:20090437003
          • comment seamonkey-chat is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060609004
        • AND
          • comment seamonkey-devel is earlier than 0:1.0.9-41.el4
            oval oval:com.redhat.rhsa:tst:20090437005
          • comment seamonkey-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060609006
        • AND
          • comment seamonkey-dom-inspector is earlier than 0:1.0.9-41.el4
            oval oval:com.redhat.rhsa:tst:20090437007
          • comment seamonkey-dom-inspector is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060609008
        • AND
          • comment seamonkey-js-debugger is earlier than 0:1.0.9-41.el4
            oval oval:com.redhat.rhsa:tst:20090437009
          • comment seamonkey-js-debugger is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060609010
        • AND
          • comment seamonkey-mail is earlier than 0:1.0.9-41.el4
            oval oval:com.redhat.rhsa:tst:20090437011
          • comment seamonkey-mail is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060609012
    rhsa
    id RHSA-2009:0437
    released 2009-04-21
    severity Critical
    title RHSA-2009:0437: seamonkey security update (Critical)
rpms
  • firefox-0:3.0.9-1.el4
  • firefox-0:3.0.9-1.el5
  • firefox-debuginfo-0:3.0.9-1.el4
  • firefox-debuginfo-0:3.0.9-1.el5
  • xulrunner-0:1.9.0.9-1.el5
  • xulrunner-debuginfo-0:1.9.0.9-1.el5
  • xulrunner-devel-0:1.9.0.9-1.el5
  • xulrunner-devel-unstable-0:1.9.0.9-1.el5
  • seamonkey-0:1.0.9-0.33.el2
  • seamonkey-0:1.0.9-0.37.el3
  • seamonkey-0:1.0.9-41.el4
  • seamonkey-chat-0:1.0.9-0.33.el2
  • seamonkey-chat-0:1.0.9-0.37.el3
  • seamonkey-chat-0:1.0.9-41.el4
  • seamonkey-debuginfo-0:1.0.9-0.37.el3
  • seamonkey-debuginfo-0:1.0.9-41.el4
  • seamonkey-devel-0:1.0.9-0.33.el2
  • seamonkey-devel-0:1.0.9-0.37.el3
  • seamonkey-devel-0:1.0.9-41.el4
  • seamonkey-dom-inspector-0:1.0.9-0.33.el2
  • seamonkey-dom-inspector-0:1.0.9-0.37.el3
  • seamonkey-dom-inspector-0:1.0.9-41.el4
  • seamonkey-js-debugger-0:1.0.9-0.33.el2
  • seamonkey-js-debugger-0:1.0.9-0.37.el3
  • seamonkey-js-debugger-0:1.0.9-41.el4
  • seamonkey-mail-0:1.0.9-0.33.el2
  • seamonkey-mail-0:1.0.9-0.37.el3
  • seamonkey-mail-0:1.0.9-41.el4
  • seamonkey-nspr-0:1.0.9-0.33.el2
  • seamonkey-nspr-0:1.0.9-0.37.el3
  • seamonkey-nspr-devel-0:1.0.9-0.33.el2
  • seamonkey-nspr-devel-0:1.0.9-0.37.el3
  • seamonkey-nss-0:1.0.9-0.33.el2
  • seamonkey-nss-0:1.0.9-0.37.el3
  • seamonkey-nss-devel-0:1.0.9-0.33.el2
  • seamonkey-nss-devel-0:1.0.9-0.37.el3
refmap via4
bid 34656
bugtraq
  • 20090702 Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome
  • 20090703 Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome
confirm
fedora FEDORA-2009-3875
mandriva MDVSA-2009:111
misc
sectrack 1022096
secunia
  • 34758
  • 34843
  • 34844
  • 34894
  • 35065
sunalert 264308
suse SUSE-SR:2009:010
ubuntu USN-764-1
vupen ADV-2009-1125
Last major update 10-10-2018 - 19:35
Published 22-04-2009 - 18:30
Last modified 10-10-2018 - 19:35
Back to Top