CVE-2009-0357
published 2009-02-04CVE-2009-0357: Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response…
PriorityP420medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.56%
72.5th percentile
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
Affected
87 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 3.0.5 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_ubuntu10.0CRITICAL
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2009-02-11·CVSS 5.0
CVE-2008-5510 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox vulnerabilities
Kojima Hajime discovered that Firefox did not properly handle an escaped null
character. An attacker may be able to exploit this flaw to bypass script
sanitization. (CVE-2008-5510)
Wladimir Palant discovered that Firefox did not restrict access to cookies in
HTTP response headers. If a user were tricked into opening a malicious web
page, a remote attacker could view sensitive information. (CVE-2009-0357)
Instructions: After a standard system upgrade you need to restart Firefox to effect the
necessary changes.
Ubuntu
Firefox and Xulrunner vulnerabilities
vendor_ubuntu·2009-02-10·CVSS 10.0
CVE-2009-0352 [CRITICAL] Firefox and Xulrunner vulnerabilities
Title: Firefox and Xulrunner vulnerabilities
Summary: Firefox and Xulrunner vulnerabilities
Several flaws were discovered in the browser engine. These problems could allow
an attacker to crash the browser and possibly execute arbitrary code with user
privileges. (CVE-2009-0352, CVE-2009-0353)
A flaw was discovered in the JavaScript engine. An attacker could bypass the
same-origin policy in Firefox by utilizing a chrome XBL method and execute
arbitrary JavaScript within the context of another website. (CVE-2009-0354)
A flaw was discovered in the browser engine when restoring closed tabs. If a
user were tricked into restoring a tab to a malicious website with form input
controls, an attacker could steal local files on the user's system.
(CVE-2009-0355)
Wladimir Palant discovered that Fi
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2009-02-10·CVSS 5.4
CVE-2009-0355 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox vulnerabilities
A flaw was discovered in the browser engine when restoring closed tabs. If a
user were tricked into restoring a tab to a malicious website with form input
controls, an attacker could steal local files on the user's system.
(CVE-2009-0355)
Wladimir Palant discovered that Firefox did not restrict access to cookies in
HTTP response headers. If a user were tricked into opening a malicious web
page, a remote attacker could view sensitive information. (CVE-2009-0357)
Instructions: After a standard system upgrade you need to restart Firefox to effect the
necessary changes.
Red Hat
Firefox XMLHttpRequest allows reading HTTPOnly cookies
vendor_redhat·2009-02-03·CVSS 5.0
CVE-2009-0357 [MEDIUM] Firefox XMLHttpRequest allows reading HTTPOnly cookies
Firefox XMLHttpRequest allows reading HTTPOnly cookies
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
GHSA
GHSA-xprr-83m2-vv8v: Mozilla Firefox before 3
ghsa_unreviewed·2022-05-02
CVE-2009-0357 [MEDIUM] GHSA-xprr-83m2-vv8v: Mozilla Firefox before 3
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
No detection rules found.
No public exploits indexed.
http://ha.ckers.org/blog/20070511/bluehat-errata/http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2009-0256.htmlhttp://secunia.com/advisories/33799http://secunia.com/advisories/33808http://secunia.com/advisories/33809http://secunia.com/advisories/33816http://secunia.com/advisories/33831http://secunia.com/advisories/33841http://secunia.com/advisories/33846http://secunia.com/advisories/33869http://secunia.com/advisories/34462http://secunia.com/advisories/34527http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420http://support.avaya.com/elmodocs2/security/ASA-2009-040.htmhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:044http://www.mozilla.org/security/announce/2009/mfsa2009-05.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0257.htmlhttp://www.securityfocus.com/bid/33598http://www.securitytracker.com/id?1021668http://www.ubuntu.com/usn/usn-717-1http://www.ubuntu.com/usn/usn-717-2http://www.vupen.com/english/advisories/2009/0313https://bugzilla.mozilla.org/show_bug.cgi?id=380418https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9459https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.htmlhttp://ha.ckers.org/blog/20070511/bluehat-errata/http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2009-0256.htmlhttp://secunia.com/advisories/33799http://secunia.com/advisories/33808http://secunia.com/advisories/33809http://secunia.com/advisories/33816http://secunia.com/advisories/33831http://secunia.com/advisories/33841http://secunia.com/advisories/33846http://secunia.com/advisories/33869http://secunia.com/advisories/34462http://secunia.com/advisories/34527http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420http://support.avaya.com/elmodocs2/security/ASA-2009-040.htmhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:044http://www.mozilla.org/security/announce/2009/mfsa2009-05.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0257.htmlhttp://www.securityfocus.com/bid/33598http://www.securitytracker.com/id?1021668http://www.ubuntu.com/usn/usn-717-1http://www.ubuntu.com/usn/usn-717-2http://www.vupen.com/english/advisories/2009/0313https://bugzilla.mozilla.org/show_bug.cgi?id=380418https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9459https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html
2009-02-04
Published