NetSight
IP …
medium4.3

CVE-2009-3014

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in…

Impact

Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location HTTP response header or (2) specifying the content of a Location HTTP response header.

Affected products

VendorProductAffected versions
MozillaFirefox
through 3.0.13
Versions 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5
MozillaMozilla
through 1.7
Versions 0.8, 0.9.2, 0.9.2.1, 0.9.3, 0.9.4
MozillaSeamonkey
Version 1.1.17

Weakness classification

CWE-79

References