CVE-2009-0358
published 2009-02-04CVE-2009-0358: Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain…
PriorityP46low3.3CVSS 2.0
AVAACLAuNCPINAN
EPSS
0.52%
41.4th percentile
Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.03.3LOWAV:A/AC:L/Au:N/C:P/I:N/A:N
vendor_ubuntu10.0CRITICAL
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qfpv-wrwf-3vwj: Mozilla Firefox 3
ghsa_unreviewed·2022-05-02
CVE-2009-0358 [LOW] CWE-200 GHSA-qfpv-wrwf-3vwj: Mozilla Firefox 3
Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
Ubuntu
Firefox and Xulrunner vulnerabilities
vendor_ubuntu·2009-02-10·CVSS 10.0
CVE-2009-0352 [CRITICAL] Firefox and Xulrunner vulnerabilities
Title: Firefox and Xulrunner vulnerabilities
Summary: Firefox and Xulrunner vulnerabilities
Several flaws were discovered in the browser engine. These problems could allow
an attacker to crash the browser and possibly execute arbitrary code with user
privileges. (CVE-2009-0352, CVE-2009-0353)
A flaw was discovered in the JavaScript engine. An attacker could bypass the
same-origin policy in Firefox by utilizing a chrome XBL method and execute
arbitrary JavaScript within the context of another website. (CVE-2009-0354)
A flaw was discovered in the browser engine when restoring closed tabs. If a
user were tricked into restoring a tab to a malicious website with form input
controls, an attacker could steal local files on the user's system.
(CVE-2009-0355)
Wladimir Palant discovered that Fi
Red Hat
Firefox directives to not cache pages ignored
vendor_redhat·2009-02-03·CVSS 3.3
CVE-2009-0358 [LOW] Firefox directives to not cache pages ignored
Firefox directives to not cache pages ignored
Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
No detection rules found.
No public exploits indexed.
http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspxhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2009-0256.htmlhttp://secunia.com/advisories/33799http://secunia.com/advisories/33809http://secunia.com/advisories/33831http://secunia.com/advisories/33841http://secunia.com/advisories/33846http://secunia.com/advisories/33869http://support.avaya.com/elmodocs2/security/ASA-2009-040.htmhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:044http://www.mozilla.org/security/announce/2009/mfsa2009-06.htmlhttp://www.securityfocus.com/bid/33598http://www.securitytracker.com/id?1021667http://www.ubuntu.com/usn/usn-717-1http://www.vupen.com/english/advisories/2009/0313https://bugzilla.mozilla.org/show_bug.cgi?id=441751https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10610https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.htmlhttp://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspxhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2009-0256.htmlhttp://secunia.com/advisories/33799http://secunia.com/advisories/33809http://secunia.com/advisories/33831http://secunia.com/advisories/33841http://secunia.com/advisories/33846http://secunia.com/advisories/33869http://support.avaya.com/elmodocs2/security/ASA-2009-040.htmhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:044http://www.mozilla.org/security/announce/2009/mfsa2009-06.htmlhttp://www.securityfocus.com/bid/33598http://www.securitytracker.com/id?1021667http://www.ubuntu.com/usn/usn-717-1http://www.vupen.com/english/advisories/2009/0313https://bugzilla.mozilla.org/show_bug.cgi?id=441751https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10610https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html
2009-02-04
Published