NVD

Id
50578  
Name
CVE-2009-3374  
Description
The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via unspecified method calls, related to "doubly-wrapped objects."  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-10-29  
Modified Date
2010-08-21  
Seq
2009-3374  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
255697 50578 CVE-2009-3374 oval:org.mitre.oval:def:6565  View
255698 50578 CVE-2009-3374 oval:org.mitre.oval:def:9789  View
255699 50578 CVE-2009-3374 272909  View
255700 50578 CVE-2009-3374 MDVSA-2009:294  View
255701 50578 CVE-2009-3374 http://www.mozilla.org/security/announce/2009/mfsa2009-57.html  View
255702 50578 CVE-2009-3374 ADV-2009-3334  View
255703 50578 CVE-2009-3374 https://bugzilla.mozilla.org/show_bug.cgi?id=505988  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41287 JVNDB-2009-002294 Mozilla Firefox の XPCOM 実装における任意の JavaScript を実行される脆弱性 Mozilla Firefox の XPCOM 実装には、リモートウェブサイトから得たオブジェクトとクローム特権のコード間の制限をしないため、クローム特権で任意の JavaScript を実行される脆弱性が存在します。 CVE-2009-3374 40805 CVE-2009-3374 50578 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002294.html 2009-10-27 2009-12-04 View