XSS in Mozilla Firefox

CVE-2009-2472

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.022 (81.0th percentile) — read the EPSS interpretation.

Affected products

Mozilla Firefox
Fedoraproject Fedora — versions 10
Opensuse — versions 11.0, 11.1
Suse Linux_enterprise_debuginfo — versions 10, 11
Suse Linux_enterprise_desktop — versions 10, 11
Suse Linux_enterprise_server — versions 10, 11
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

secalert@redhat.com (vendor-advisory, x_refsource_SUNALERT, Broken Link)
secalert@redhat.com (vendor-advisory, x_refsource_SUNALERT, Broken Link)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Issue Tracking, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Broken Link)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Issue Tracking, Vendor Advisory)