Bug 483142 (CVE-2009-0354)

Summary:	CVE-2009-0354 Firefox XSS using a chrome XBL method and window.eval
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kseifried
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0354
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-09-30 23:17:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	480966
Bug Blocks:

Description Josh Bressers 2009-01-29 20:38:02 UTC

Mozilla security researcher moz_bug_r_a4 reported that a chrome XBL method
can be used in conjuction with window.eval to execute arbitrary JavaScript
within the context of another website, violating the same origin policy.

Comment 2 Tomas Hoger 2009-02-04 08:07:37 UTC

Public now via MFSA 2009-02:
http://www.mozilla.org/security/announce/2009/mfsa2009-02.html

Comment 3 Fedora Update System 2009-02-06 05:20:08 UTC

xulrunner-1.9.0.6-1.fc10, firefox-3.0.6-1.fc10, epiphany-extensions-2.24.0-4.fc10, epiphany-2.24.3-2.fc10, blam-1.8.5-6.fc10, devhelp-0.22-3.fc10, evolution-rss-0.1.2-4.fc10, galeon-2.0.7-5.fc10, gecko-sharp2-0.13-4.fc10, gnome-python2-extras-2.19.1-26.fc10, gnome-web-photo-0.3-14.fc10, google-gadgets-0.10.5-2.fc10, kazehakase-0.5.6-1.fc10.3, Miro-1.2.8-2.fc10, mozvoikko-0.9.5-6.fc10, mugshot-1.2.2-5.fc10, pcmanx-gtk2-0.3.8-5.fc10, ruby-gnome2-0.18.1-3.fc10, yelp-2.24.0-5.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2009-02-06 05:21:43 UTC

xulrunner-1.9.0.6-1.fc9, firefox-3.0.6-1.fc9, epiphany-extensions-2.22.1-7.fc9, epiphany-2.22.2-7.fc9, blam-1.8.5-5.fc9.1, cairo-dock-1.6.3.1-1.fc9.3, chmsee-1.0.1-8.fc9, devhelp-0.19.1-8.fc9, evolution-rss-0.1.0-6.fc9, galeon-2.0.7-5.fc9, gnome-python2-extras-2.19.1-23.fc9, gnome-web-photo-0.3-17.fc9, google-gadgets-0.10.5-2.fc9, gtkmozembedmm-1.4.2.cvs20060817-25.fc9, kazehakase-0.5.6-1.fc9.3, Miro-1.2.7-4.fc9, mozvoikko-0.9.5-6.fc9, mugshot-1.2.2-5.fc9, ruby-gnome2-0.17.0-5.fc9, totem-2.23.2-10.fc9, yelp-2.22.1-8.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Kurt Seifried 2011-09-30 23:17:55 UTC

This issue has been addressed in following products:

  Red Hat Linux Enterprise 4
  Red Hat Linux Enterprise 4.7.z
  Red Hat Linux Enterprise 5
  Red Hat Linux Enterprise 5.3.z

Via RHSA-2009:0256 available at
https://rhn.redhat.com/errata/RHSA-2009-0256.html