CVE-2009-3986

2009-12-1717:30:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2009-3986

mozilla firefox

seamonkey

remote code execution

javascript

security vulnerability

9.4 High

AI Score

Confidence

High

7.6 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

0.017 Low

EPSS

Percentile

87.5%

JSON

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript with chrome privileges by leveraging a reference to a chrome window from a content window, related to the window.opener property.

CPENameOperatorVersion
mozilla:seamonkeymozilla seamonkeyeq1.1.10
mozilla:firefoxmozilla firefoxeq0.1
mozilla:seamonkeymozilla seamonkeyeq1.0.3
mozilla:firefoxmozilla firefoxeq0.8
mozilla:firefoxmozilla firefoxeq2.0.0.12
mozilla:firefoxmozilla firefoxeq1.5
mozilla:firefoxmozilla firefoxeq2.0_.7
mozilla:firefoxmozilla firefoxeq3.5.3
mozilla:seamonkeymozilla seamonkeyeq1.1.8
mozilla:firefoxmozilla firefoxeq3.0.7

CPE	Name	Operator	Version
mozilla:seamonkey	mozilla seamonkey	eq	1.1.10
mozilla:firefox	mozilla firefox	eq	0.1
mozilla:seamonkey	mozilla seamonkey	eq	1.0.3
mozilla:firefox	mozilla firefox	eq	0.8
mozilla:firefox	mozilla firefox	eq	2.0.0.12
mozilla:firefox	mozilla firefox	eq	1.5
mozilla:firefox	mozilla firefox	eq	2.0_.7
mozilla:firefox	mozilla firefox	eq	3.5.3
mozilla:seamonkey	mozilla seamonkey	eq	1.1.8
mozilla:firefox	mozilla firefox	eq	3.0.7