QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2009-1312

Back to search

CVE-2009-1312

Published: Apr 22, 2009

Modified: Aug 7, 2024

PUBLISHED

Description

Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.

VendorProductVersions

n/a

n/a

affected
n/a

References

MDVSA-2009:111
vendor-advisory
x_refsource_MANDRIVA
FEDORA-2009-3875
vendor-advisory
x_refsource_FEDORA
34894
third-party-advisory
x_refsource_SECUNIA
ADV-2009-1125
vdb-entry
x_refsource_VUPEN
oval:org.mitre.oval:def:9818
vdb-entry
signature
x_refsource_OVAL
34758
third-party-advisory
x_refsource_SECUNIA
oval:org.mitre.oval:def:6131
vdb-entry
signature
x_refsource_OVAL
1022096
vdb-entry
x_refsource_SECTRACK
oval:org.mitre.oval:def:6064
vdb-entry
signature
x_refsource_OVAL
34844
third-party-advisory
x_refsource_SECUNIA
35065
third-party-advisory
x_refsource_SECUNIA
oval:org.mitre.oval:def:6731
vdb-entry
signature
x_refsource_OVAL
USN-764-1
vendor-advisory
x_refsource_UBUNTU
SUSE-SR:2009:010
vendor-advisory
x_refsource_SUSE
34656
vdb-entry
x_refsource_BID
34843
third-party-advisory
x_refsource_SECUNIA
RHSA-2009:0437
vendor-advisory
x_refsource_REDHAT
RHSA-2009:0436
vendor-advisory
x_refsource_REDHAT
264308
vendor-advisory
x_refsource_SUNALERT

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now