CVE-2009-0357

Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 74.32%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
≤ 3.0.5
mozillafirefox_esr
𝑥
≤ 3.0.5
mozillafirefox
0.1
mozillafirefox_esr
0.1
mozillafirefox
0.2
mozillafirefox_esr
0.2
mozillafirefox
0.3
mozillafirefox_esr
0.3
mozillafirefox
0.4
mozillafirefox_esr
0.4
mozillafirefox
0.5
mozillafirefox_esr
0.5
mozillafirefox
0.6
mozillafirefox_esr
0.6
mozillafirefox
0.6.1
mozillafirefox_esr
0.6.1
mozillafirefox
0.7
mozillafirefox_esr
0.7
mozillafirefox
0.7.1
mozillafirefox_esr
0.7.1
mozillafirefox
0.8
mozillafirefox_esr
0.8
mozillafirefox
0.9
mozillafirefox_esr
0.9
mozillafirefox
0.9.1
mozillafirefox_esr
0.9.1
mozillafirefox
0.9.2
mozillafirefox_esr
0.9.2
mozillafirefox
0.9.3
mozillafirefox_esr
0.9.3
mozillafirefox
1.0
mozillafirefox_esr
1.0
mozillafirefox
1.0:preview_release
mozillafirefox_esr
1.0:preview_release
mozillafirefox
1.0.1
mozillafirefox_esr
1.0.1
mozillafirefox
1.0.2
mozillafirefox_esr
1.0.2
mozillafirefox
1.0.3
mozillafirefox_esr
1.0.3
mozillafirefox
1.0.4
mozillafirefox_esr
1.0.4
mozillafirefox
1.0.5
mozillafirefox_esr
1.0.5
mozillafirefox
1.0.6
mozillafirefox_esr
1.0.6
mozillafirefox
1.0.7
mozillafirefox_esr
1.0.7
mozillafirefox
1.0.8
mozillafirefox_esr
1.0.8
mozillafirefox
1.5
mozillafirefox_esr
1.5
mozillafirefox
1.5.0.1
mozillafirefox_esr
1.5.0.1
mozillafirefox
1.5.0.2
mozillafirefox_esr
1.5.0.2
mozillafirefox
1.5.0.3
mozillafirefox_esr
1.5.0.3
mozillafirefox
1.5.0.4
mozillafirefox_esr
1.5.0.4
mozillafirefox
1.5.0.5
mozillafirefox_esr
1.5.0.5
mozillafirefox
1.5.0.6
mozillafirefox_esr
1.5.0.6
mozillafirefox
1.5.0.7
mozillafirefox_esr
1.5.0.7
mozillafirefox
1.5.0.8
mozillafirefox_esr
1.5.0.8
mozillafirefox
1.5.0.9
mozillafirefox_esr
1.5.0.9
mozillafirefox
1.5.0.10
mozillafirefox_esr
1.5.0.10
mozillafirefox
1.5.0.11
mozillafirefox_esr
1.5.0.11
mozillafirefox
1.5.0.12
mozillafirefox_esr
1.5.0.12
mozillafirefox
2.0
mozillafirefox_esr
2.0
mozillafirefox
2.0:beta1
mozillafirefox_esr
2.0:beta1
mozillafirefox
2.0:rc2
mozillafirefox_esr
2.0:rc2
mozillafirefox
2.0:rc3
mozillafirefox_esr
2.0:rc3
mozillafirefox
2.0.0.1
mozillafirefox_esr
2.0.0.1
mozillafirefox
2.0.0.2
mozillafirefox_esr
2.0.0.2
mozillafirefox
2.0.0.3
mozillafirefox_esr
2.0.0.3
mozillafirefox
2.0.0.4
mozillafirefox_esr
2.0.0.4
mozillafirefox
2.0.0.5
mozillafirefox_esr
2.0.0.5
mozillafirefox
2.0.0.6
mozillafirefox_esr
2.0.0.6
mozillafirefox
2.0.0.7
mozillafirefox_esr
2.0.0.7
mozillafirefox
2.0.0.8
mozillafirefox_esr
2.0.0.8
mozillafirefox
2.0.0.9
mozillafirefox_esr
2.0.0.9
mozillafirefox
2.0.0.10
mozillafirefox_esr
2.0.0.10
mozillafirefox
2.0.0.11
mozillafirefox_esr
2.0.0.11
mozillafirefox
2.0.0.12
mozillafirefox_esr
2.0.0.12
mozillafirefox
2.0.0.13
mozillafirefox_esr
2.0.0.13
mozillafirefox
2.0.0.14
mozillafirefox_esr
2.0.0.14
mozillafirefox
2.0.0.15
mozillafirefox_esr
2.0.0.15
mozillafirefox
2.0.0.16
mozillafirefox_esr
2.0.0.16
mozillafirefox
2.0.0.17
mozillafirefox_esr
2.0.0.17
mozillafirefox
2.0.0.18
mozillafirefox_esr
2.0.0.18
mozillafirefox
2.0.0.19
mozillafirefox_esr
2.0.0.19
mozillafirefox
2.0.0.20
mozillafirefox_esr
2.0.0.20
mozillafirefox
3.0
mozillafirefox_esr
3.0
mozillafirefox
3.0:alpha
mozillafirefox_esr
3.0:alpha
mozillafirefox
3.0:beta2
mozillafirefox_esr
3.0:beta2
mozillafirefox
3.0:beta5
mozillafirefox_esr
3.0:beta5
mozillafirefox
3.0.1
mozillafirefox_esr
3.0.1
mozillafirefox
3.0.2
mozillafirefox_esr
3.0.2
mozillafirefox
3.0.3
mozillafirefox_esr
3.0.3
mozillafirefox
3.0.4
mozillafirefox_esr
3.0.4
mozillaseamonkey
𝑥
≤ 1.1.13
mozillaseamonkey
1.0
mozillaseamonkey
1.0:alpha
mozillaseamonkey
1.0:beta
mozillaseamonkey
1.0.1
mozillaseamonkey
1.0.2
mozillaseamonkey
1.0.3
mozillaseamonkey
1.0.4
mozillaseamonkey
1.0.5
mozillaseamonkey
1.0.6
mozillaseamonkey
1.0.7
mozillaseamonkey
1.0.8
mozillaseamonkey
1.0.9
mozillaseamonkey
1.1
mozillaseamonkey
1.1:alpha
mozillaseamonkey
1.1:beta
mozillaseamonkey
1.1.1
mozillaseamonkey
1.1.2
mozillaseamonkey
1.1.3
mozillaseamonkey
1.1.4
mozillaseamonkey
1.1.5
mozillaseamonkey
1.1.6
mozillaseamonkey
1.1.7
mozillaseamonkey
1.1.8
mozillaseamonkey
1.1.9
mozillaseamonkey
1.1.10
mozillaseamonkey
1.1.11
mozillaseamonkey
1.1.12
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
dapper
Fixed 1.5.dfsg+1.5.0.15~prepatch080614j-0ubuntu1
released
gutsy
Fixed 2.0.0.21~20090209t122238+nobinonly-0ubuntu0.7.10.1
released
hardy
ignored
intrepid
dne
jaunty
dne
karmic
dne
lucid
not-affected
maverick
not-affected
natty
not-affected
iceape
dapper
dne
gutsy
ignored
hardy
dne
intrepid
dne
jaunty
dne
karmic
dne
lucid
dne
maverick
dne
natty
dne
seamonkey
dapper
dne
gutsy
dne
hardy
Fixed 1.1.15+nobinonly-0ubuntu0.8.04.2
released
intrepid
Fixed 1.1.15+nobinonly-0ubuntu0.8.10.2
released
jaunty
Fixed 1.1.15+nobinonly-0ubuntu2
released
karmic
Fixed 1.1.15+nobinonly-0ubuntu2
released
lucid
Fixed 1.1.15+nobinonly-0ubuntu2
released
maverick
Fixed 1.1.15+nobinonly-0ubuntu2
released
natty
Fixed 1.1.15+nobinonly-0ubuntu2
released
xulrunner
dapper
dne
gutsy
Fixed 1.8.1.18+nobinonly.b308.cvs20090331t155113-0ubuntu0.7.10.1
released
hardy
Fixed 1.8.1.18+nobinonly.b308.cvs20090331t155113-0ubuntu0.8.04.1
released
intrepid
Fixed 1.8.1.18+nobinonly.b308.cvs20090331t155113-0ubuntu0.8.10.1
released
jaunty
ignored
karmic
ignored
lucid
dne
maverick
dne
natty
dne
xulrunner-1.9
dapper
dne
gutsy
ignored
hardy
Fixed 1.9.0.6+nobinonly-0ubuntu0.8.04.1
released
intrepid
Fixed 1.9.0.6+nobinonly-0ubuntu0.8.10.1
released
jaunty
Fixed 1.9.0.6+nobinonly-0ubuntu1
released
karmic
dne
lucid
dne
maverick
dne
natty
dne
Common Weakness Enumeration
References
http://ha.ckers.org/blog/20070511/bluehat-errata/
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html
http://rhn.redhat.com/errata/RHSA-2009-0256.html
http://secunia.com/advisories/33799
http://secunia.com/advisories/33808
http://secunia.com/advisories/33809
http://secunia.com/advisories/33816
http://secunia.com/advisories/33831
http://secunia.com/advisories/33841
http://secunia.com/advisories/33846
http://secunia.com/advisories/33869
http://secunia.com/advisories/34462
http://secunia.com/advisories/34527
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420
http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm
http://www.mandriva.com/security/advisories?name=MDVSA-2009:044
http://www.mozilla.org/security/announce/2009/mfsa2009-05.html
http://www.redhat.com/support/errata/RHSA-2009-0257.html
http://www.securityfocus.com/bid/33598
http://www.securitytracker.com/id?1021668
http://www.ubuntu.com/usn/usn-717-1
http://www.ubuntu.com/usn/usn-717-2
http://www.vupen.com/english/advisories/2009/0313
https://bugzilla.mozilla.org/show_bug.cgi?id=380418
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9459
https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html
http://ha.ckers.org/blog/20070511/bluehat-errata/
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html
http://rhn.redhat.com/errata/RHSA-2009-0256.html
http://secunia.com/advisories/33799
http://secunia.com/advisories/33808
http://secunia.com/advisories/33809
http://secunia.com/advisories/33816
http://secunia.com/advisories/33831
http://secunia.com/advisories/33841
http://secunia.com/advisories/33846
http://secunia.com/advisories/33869
http://secunia.com/advisories/34462
http://secunia.com/advisories/34527
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420
http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm
http://www.mandriva.com/security/advisories?name=MDVSA-2009:044
http://www.mozilla.org/security/announce/2009/mfsa2009-05.html
http://www.redhat.com/support/errata/RHSA-2009-0257.html
http://www.securityfocus.com/bid/33598
http://www.securitytracker.com/id?1021668
http://www.ubuntu.com/usn/usn-717-1
http://www.ubuntu.com/usn/usn-717-2
http://www.vupen.com/english/advisories/2009/0313
https://bugzilla.mozilla.org/show_bug.cgi?id=380418
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9459
https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html