CVE-2009-3374

Publication date 29 October 2009

Last updated 24 July 2024

Ubuntu priority

The XPCVariant::VariantDataToJS function in the XPCOM implementation in Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 does not enforce intended restrictions on interaction between chrome privileged code and objects obtained from remote web sites, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via unspecified method calls, related to "doubly-wrapped objects."

Status

Show unmaintained releases

Package	Ubuntu Release	Status
firefox-3.0	9.10 karmic	Not in release
	9.04 jaunty	Fixed 3.0.15+nobinonly-0ubuntu0.9.04.1
	8.10 intrepid	Fixed 3.0.15+nobinonly-0ubuntu0.8.10.1
	8.04 LTS hardy	Fixed 3.0.15+nobinonly-0ubuntu0.8.04.1
	6.06 LTS dapper	Not in release
firefox-3.5	9.10 karmic	Fixed 3.5.4+nobinonly-0ubuntu0.9.10.1
	9.04 jaunty	Fixed 3.5.4+nobinonly-0ubuntu0.9.04.1
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
xulrunner-1.9	9.10 karmic	Not in release
	9.04 jaunty	Fixed 1.9.0.15+nobinonly-0ubuntu0.9.04.1
	8.10 intrepid	Fixed 1.9.0.15+nobinonly-0ubuntu0.8.10.1
	8.04 LTS hardy	Fixed 1.9.0.15+nobinonly-0ubuntu0.8.04.1
	6.06 LTS dapper	Not in release
xulrunner-1.9.1	9.10 karmic	Fixed 1.9.1.4+nobinonly-0ubuntu0.9.10.1
	9.04 jaunty	Fixed 1.9.1.4+nobinonly-0ubuntu0.9.04.3
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release

CVE-2009-3374

Status

References

Related Ubuntu Security Notices (USN)

Other references