CVE-2009-3984
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a…
Does this matter?
Lower severity and a low EPSS score (2.19%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status code and an empty body.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.19% probability · 81th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/37699Vendor Advisory
- http://secunia.com/advisories/37703Vendor Advisory
- http://secunia.com/advisories/37704Vendor Advisory
- http://secunia.com/advisories/37785Vendor Advisory
- http://secunia.com/advisories/37813
- http://secunia.com/advisories/37856
- http://secunia.com/advisories/37881
- http://securitytracker.com/id?1023342
- http://securitytracker.com/id?1023343
- http://www.debian.org/security/2009/dsa-1956
- http://www.mozilla.org/security/announce/2009/mfsa2009-69.htmlPatch, Vendor Advisory
- http://www.novell.com/linux/security/advisories/2009_63_firefox.html
- http://www.securityfocus.com/bid/37349
- http://www.securityfocus.com/bid/37367
- http://www.ubuntu.com/usn/USN-873-1
- http://www.ubuntu.com/usn/USN-874-1
- http://www.vupen.com/english/advisories/2009/3547Patch, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=521461
- https://bugzilla.redhat.com/show_bug.cgi?id=546722
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54806
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8379
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9791
- https://rhn.redhat.com/errata/RHSA-2009-1673.html
- https://rhn.redhat.com/errata/RHSA-2009-1674.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00995.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01034.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01041.html
- http://secunia.com/advisories/37699Vendor Advisory
- http://secunia.com/advisories/37703Vendor Advisory
- http://secunia.com/advisories/37704Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.