CVE-2009-2472

MEDIUM 4.3CVE-2009-2472 · Published 22/07/2009 · updated 16/06/2026

In short

CVE-2009-2472 is a MEDIUM (CVSS 4.3) vulnerability affecting firefox (mozilla), linux enterprise debuginfo (suse).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.9% of all vulnerabilities.
Fix: update to 3.0.12 or later.

Package	Affected versions	Patched versions
firefox mozilla	`< 3.0.12`	`3.0.12`
linux enterprise debuginfo suse	`= 10= 11`	No fix yet

Description

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."

References

lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html · Mailing List
rhn.redhat.com/errata/RHSA-2009-1162.html · Broken Link
secunia.com/advisories/35914 · Third Party Advisory
secunia.com/advisories/35944 · Third Party Advisory
secunia.com/advisories/36005 · Third Party Advisory
secunia.com/advisories/36145 · Third Party Advisory
sunsolve.sun.com/search/document.do · Broken Link
sunsolve.sun.com/search/document.do · Broken Link
mozilla.org/security/announce/2009/mfsa2009-40.html · Patch
securityfocus.com/bid/35758 · Patch
vupen.com/english/advisories/2009/1972

More vulnerabilities in firefox

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free