QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2009-1306

Back to search

CVE-2009-1306

Published: Apr 22, 2009

Modified: Aug 7, 2024

PUBLISHED

Description

The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via an uploaded .jar file with a "Content-Disposition: attachment" designation.

VendorProductVersions

n/a

n/a

affected
n/a

References

MDVSA-2009:111
vendor-advisory
x_refsource_MANDRIVA
oval:org.mitre.oval:def:6021
vdb-entry
signature
x_refsource_OVAL
FEDORA-2009-3875
vendor-advisory
x_refsource_FEDORA
34894
third-party-advisory
x_refsource_SECUNIA
oval:org.mitre.oval:def:6710
vdb-entry
signature
x_refsource_OVAL
ADV-2009-1125
vdb-entry
x_refsource_VUPEN
oval:org.mitre.oval:def:10150
vdb-entry
signature
x_refsource_OVAL
34758
third-party-advisory
x_refsource_SECUNIA
35536
third-party-advisory
x_refsource_SECUNIA
RHSA-2009:1125
vendor-advisory
x_refsource_REDHAT
34844
third-party-advisory
x_refsource_SECUNIA
USN-782-1
vendor-advisory
x_refsource_UBUNTU
35065
third-party-advisory
x_refsource_SECUNIA
1022095
vdb-entry
x_refsource_SECTRACK
USN-764-1
vendor-advisory
x_refsource_UBUNTU
MDVSA-2009:141
vendor-advisory
x_refsource_MANDRIVA
SUSE-SR:2009:010
vendor-advisory
x_refsource_SUSE
oval:org.mitre.oval:def:6194
vdb-entry
signature
x_refsource_OVAL
35042
third-party-advisory
x_refsource_SECUNIA
34656
vdb-entry
x_refsource_BID
34843
third-party-advisory
x_refsource_SECUNIA
DSA-1797
vendor-advisory
x_refsource_DEBIAN
RHSA-2009:0437
vendor-advisory
x_refsource_REDHAT
RHSA-2009:0436
vendor-advisory
x_refsource_REDHAT
RHSA-2009:1126
vendor-advisory
x_refsource_REDHAT
34780
third-party-advisory
x_refsource_SECUNIA
264308
vendor-advisory
x_refsource_SUNALERT
oval:org.mitre.oval:def:6312
vdb-entry
signature
x_refsource_OVAL

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now