CVE-2009-3986

CVSS V2 High 7.6 CVSS V3 None
Description
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript with chrome privileges by leveraging a reference to a chrome window from a content window, related to the window.opener property.
Overview
  • CVE ID
  • CVE-2009-3986
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2009-12-17T17:30:00
  • Last Modified Date
  • 2017-09-19T01:29:52
Weakness Enumerations
CWE URL
CWE-94 http://cwe.mitre.org/data/definitions/94.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* 1 OR 3.0.15
cpe:2.3:a:mozilla:firefox:0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.6.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.7.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.4.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0:beta_1:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0:beta1:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0:rc3:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.18:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.19:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0.0.21:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0_.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0_.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0_.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0_.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0_.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0_.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0_.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:2.0_8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0:beta2:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.0.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.5.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:3.5.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:*:rc2:*:*:*:*:*:* 1 OR 2.0
cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.0.99:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:1.5.0.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0a1:*:pre:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:2.0a1pre:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:H/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • HIGH
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 7.6
  • Severity
  • HIGH
  • Exploitability Score
  • 4.9
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://www.mozilla.org/security/announce/2009/mfsa2009-70.html Vendor Advisory
http://www.securityfocus.com/bid/37365
http://secunia.com/advisories/37699 Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=522430
http://secunia.com/advisories/37704 Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2009-1674.html
http://securitytracker.com/id?1023345 Patch
http://www.vupen.com/english/advisories/2009/3547 Patch Vendor Advisory
http://secunia.com/advisories/37785 Vendor Advisory
http://securitytracker.com/id?1023344 Patch
https://bugzilla.redhat.com/show_bug.cgi?id=546724
http://www.securityfocus.com/bid/37349
http://www.ubuntu.com/usn/USN-873-1
http://www.ubuntu.com/usn/USN-874-1
http://www.debian.org/security/2009/dsa-1956
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01041.html
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00995.html
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01034.html
http://secunia.com/advisories/37881
http://secunia.com/advisories/37813
http://secunia.com/advisories/37856
http://www.novell.com/linux/security/advisories/2009_63_firefox.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/54803
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8489
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11568
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2009-3986
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3986
History
Created Old Value New Value Data Type Notes
2022-05-10 08:35:47 Added to TrackCVE