Lucene search
RootSSV:15019HistoryDec 03, 2009 - 12:00 a.m.
Firefox Sage扩展RSS源跨域脚本执行漏洞
2009-12-0300:00:00
Root
www.seebug.org
11
0.018 Low
EPSS
Percentile
86.7%
BUGTRAQ ID: 37120
CVE(CAN) ID: CVE-2009-4102
Sage是Firefox所使用的轻型RSS和Atom源汇集器扩展。
Sage没有正确地过滤RSS源中的description标签输入便用于渲染内容，用户受骗订阅了恶意的RSS源就会导致以chrome:权限执行任意脚本代码。
Mozilla Sage 1.4.3
厂商补丁：
Mozilla
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
Related
securityvulns
securityvulns
[SECURITY] [DSA 1951-1] New firefox-sage packages fix insufficient input sanitizing
2009-12-15 00:00:00
firefox-sage RSS reader crossite scripting
2009-12-15 00:00:00
nessus
nessus
Debian DSA-1951-1 : firefox-sage - insufficient input sanitising
2010-02-24 00:00:00
debian
debian
openvas
openvas
Debian: Security Advisory (DSA-1951-1)
2009-12-30 00:00:00
Debian Security Advisory DSA 1951-1 (firefox-sage)
2009-12-30 00:00:00
prion
prion
Cross site scripting
2009-11-29 13:08:00
Cross site scripting
2011-09-08 18:55:00
ubuntucve
ubuntucve
CVE-2009-4102
2009-11-29 00:00:00
cve
cve
CVE-2009-4102
2009-11-29 13:08:00
CVE-2011-3384
2011-09-08 18:55:00
jvn
jvn
JVN#99203127: Sage vulnerable to arbitrary script execution
2011-09-02 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2370
2024-03-12 08:35:15