VulnerabilityModified
CVE-2009-2472
Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document,…
MEDIUM 4.3EPSS 2.24%
Does this matter?
Lower severity and a low EPSS score (2.24%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.24% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mozilla/firefox · fedoraproject/fedora · suse/linux enterprise debuginfo · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise server
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2009-1162.htmlBroken Link
- http://secunia.com/advisories/35914Third Party Advisory
- http://secunia.com/advisories/35944Third Party Advisory
- http://secunia.com/advisories/36005Third Party Advisory
- http://secunia.com/advisories/36145Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1Broken Link
- http://www.mozilla.org/security/announce/2009/mfsa2009-40.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/35758Patch, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2009/1972Patch, Third Party Advisory
- http://www.vupen.com/english/advisories/2009/2152Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=479288Issue Tracking, Patch, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=481434Issue Tracking, Patch, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=497102Issue Tracking, Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9497Third Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01032.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2009-1162.htmlBroken Link
- http://secunia.com/advisories/35914Third Party Advisory
- http://secunia.com/advisories/35944Third Party Advisory
- http://secunia.com/advisories/36005Third Party Advisory
- http://secunia.com/advisories/36145Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1Broken Link
- http://www.mozilla.org/security/announce/2009/mfsa2009-40.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/35758Patch, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2009/1972Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.