CVE-2009-3988 json
Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object pr…
published 2010-02-21 16 y ago modified 2026-06-16 4 mo ago also EUVD-2009-3959
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.
Patch / fix
- firefox RHEL 4 3.0.18-1.el4
- firefox RHEL 5 3.0.18-1.el5_4
- xulrunner RHEL 5 1.9.0.18-1.el5_4
- xulrunner-devel-unstable RHEL 5 1.9.0.18-1.el5_4
red hat advisories RHSA-2010:0112
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2009-3988 updated cvss 4.3
Mozilla violation of same-origin policy due to properties set on objects passed to showModalDialog (MFSA 2010-04)
-
Red Hat Enterprise Linux (v. 5 server) firefox 3.0.18-1.el5_4, xulrunner 1.9.0.18-1.el5_4, xulrunner-devel-unstable 1.9.0.18-1.el5_4 Red Hat Enterprise Linux AS version 4 firefox 3.0.18-1.el4 Red Hat Enterprise Linux Desktop (v. 5 client) firefox 3.0.18-1.el5_4, xulrunner 1.9.0.18-1.el5_4, xulrunner-devel-unstable 1.9.0.18-1.el5_4 Red Hat Enterprise Linux Desktop version 4 firefox 3.0.18-1.el4 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xulrunner 1.9.0.18-1.el5_4, xulrunner-devel-unstable 1.9.0.18-1.el5_4 Red Hat Enterprise Linux ES version 4 firefox 3.0.18-1.el4fixed: vendor fix RHSA-2010:0112
+1 more productsfewer
Red Hat Enterprise Linux WS version 4 firefox 3.0.18-1.el4
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.13% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
ubuntu.com
/usn/USN-895-1
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2010-03/msg00001.html
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2010:042
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2010-February/035367.html
vendor-advisory
-
redhat.com
/support/errata/RHSA-2010-0112.html
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2010-February/035346.html
vendor-advisory
-
debian.org
/security/2010/dsa-1999
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2010-February/035426.html
vendor-advisory
-
ubuntu.com
/usn/USN-896-1
vendor-advisory
-
secunia.com
/advisories/38847
third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355
vdb-entry, signature
-
exchange.xforce.ibmcloud.com
/vulnerabilities/56362
vdb-entry
-
vupen.com
/english/advisories/2010/0405
vdb-entry
-
secunia.com
/advisories/37242
third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384
vdb-entry, signature
- mozilla.org /security/announce/2010/mfsa2010-04.html
- bugzilla.mozilla.org /show_bug.cgi?id=504862
Sources
- CVE List CVE-2009-3988
- NVD CVE-2009-3988
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.