CVE-2009-0357

Mozilla Firefox <3.0.6 & SeaMonkey <1.1.15 - Info Disclosure

Title source: llm

Description

Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.

References (27)

Core 27

Core References

Vendor Advisory x_refsource_confirm

http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm

Vendor Advisory vendor-advisory x_refsource_slackware

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33808

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/0313

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33809

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2009:044

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2009-0256.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1021668

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=380418

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33831

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/usn-717-2

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33841

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34527

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33816

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33846

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2009/mfsa2009-05.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33799

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2009-0257.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9459

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/34462

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/33598

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html

Various Sources x_refsource_misc

http://ha.ckers.org/blog/20070511/bluehat-errata/

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33869

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/usn-717-1

Scores

EPSS 0.0156

EPSS Percentile 72.5%

Details

CWE

CWE-264

Status published

Products (46)

mozilla/firefox 0.1

mozilla/firefox 0.2

mozilla/firefox 0.3

mozilla/firefox 0.4

mozilla/firefox 0.5

mozilla/firefox 0.6

mozilla/firefox 0.6.1

mozilla/firefox 0.7

mozilla/firefox 0.7.1

mozilla/firefox 0.8

... and 36 more

Published Feb 04, 2009

Tracked Since Feb 18, 2026