Description
Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
References (19)
Core 19
Core References
Vendor Advisory x_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1021667
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0313
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33809
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:044
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2009-0256.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33831
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33841
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33846
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33799
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10610
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=441751
Various Sources x_refsource_misc
http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspx
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2009/mfsa2009-06.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/33598
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00240.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33869
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-717-1
Scores
EPSS
0.0052
EPSS Percentile
40.6%
Details
CWE
CWE-200
Status
published
Products (6)
mozilla/firefox
3.0 (4 CPE variants)
mozilla/firefox
3.0.1
mozilla/firefox
3.0.2
mozilla/firefox
3.0.3
mozilla/firefox
3.0.4
mozilla/firefox
3.0.5
Published
Feb 04, 2009
Tracked Since
Feb 18, 2026