CVE-2009-3385

SeaMonkey < 1.1.19 - Information Disclosure via Scriptable Plugin Content in HTML Email

Title source: llm
STIX 2.1

Description

The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/38830
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39001
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10271
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=371976
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/0648

Scores

EPSS 0.0277
EPSS Percentile 84.7%

Details

CWE
CWE-264
Status published
Products (29)
mozilla/seamonkey 1.0 (3 CPE variants)
mozilla/seamonkey 1.0.1
mozilla/seamonkey 1.0.2
mozilla/seamonkey 1.0.3
mozilla/seamonkey 1.0.4
mozilla/seamonkey 1.0.5
mozilla/seamonkey 1.0.6
mozilla/seamonkey 1.0.7
mozilla/seamonkey 1.0.8
mozilla/seamonkey 1.0.9
... and 19 more
Published Mar 23, 2010
Tracked Since Feb 18, 2026