PublicDateAtUSN: 2009-04-22
Candidate: CVE-2009-1307
PublicDate: 2009-04-22 18:30:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1307
 https://ubuntu.com/security/notices/USN-764-1
 https://ubuntu.com/security/notices/USN-782-1
Description:
 The view-source: URI implementation in Mozilla Firefox before 3.0.9,
 Thunderbird, and SeaMonkey does not properly implement the Same Origin
 Policy, which allows remote attackers to (1) bypass crossdomain.xml
 restrictions and connect to arbitrary web sites via a Flash file; (2) read,
 create, or modify Local Shared Objects via a Flash file; or (3) bypass
 unspecified restrictions and render content via vectors involving a jar:
 URI.
Ubuntu-Description:
Notes:
 jdstrand> CVEs in Firefox are tracked in the xulrunner source packages. The
  mapping of xulrunner sources to firefox is:
   xulrunner (1.8.0): firefox (1.5) - Ubuntu 6.06 LTS
   xulrunner (1.8.1): firefox (2.0) - Ubuntu 6.10 - 8.04 LTS
   xulrunner-1.9: firefox-3.0
   xulrunner-1.9.1: firefox-3.5
 jdstrand> Ubuntu 6.06 LTS and 10.04 LTS uses the embedded xulrunner and not
  the system xulrunner-1.9.2, so it is tracked in the firefox source package.
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS: 

Patches_firefox:
upstream_firefox: needs-triage
dapper_firefox: ignored (reached end-of-life)
hardy_firefox: ignored (uses system xulrunner)
intrepid_firefox: DNE
jaunty_firefox: DNE
karmic_firefox: DNE
lucid_firefox: not-affected
maverick_firefox: not-affected
natty_firefox: not-affected
oneiric_firefox: not-affected
devel_firefox: not-affected


Patches_xulrunner:
upstream_xulrunner: needs-triage
dapper_xulrunner: DNE
hardy_xulrunner: ignored (reached end-of-life)
intrepid_xulrunner: needed (reached end-of-life)
jaunty_xulrunner: ignored (reached end-of-life)
karmic_xulrunner: ignored (reached end-of-life)
lucid_xulrunner: DNE
maverick_xulrunner: DNE
natty_xulrunner: DNE
oneiric_xulrunner: DNE
devel_xulrunner: DNE

Patches_xulrunner-1.9:
upstream_xulrunner-1.9: needs-triage
dapper_xulrunner-1.9: DNE
gutsy_xulrunner-1.9: needed (reached end-of-life)
hardy_xulrunner-1.9: released (1.9.0.9+nobinonly-0ubuntu0.8.04.1)
intrepid_xulrunner-1.9: released (1.9.0.9+nobinonly-0ubuntu0.8.10.1)
jaunty_xulrunner-1.9: released (1.9.0.9+nobinonly-0ubuntu0.9.04.1)
karmic_xulrunner-1.9: DNE
lucid_xulrunner-1.9: DNE
maverick_xulrunner-1.9: DNE
natty_xulrunner-1.9: DNE
oneiric_xulrunner-1.9: DNE
devel_xulrunner-1.9: DNE

Patches_xulrunner-1.9.1:
upstream_xulrunner-1.9.1: needs-triage
dapper_xulrunner-1.9.1: DNE
hardy_xulrunner-1.9.1: DNE
intrepid_xulrunner-1.9.1: DNE
jaunty_xulrunner-1.9.1: released (1.9.1+nobinonly-0ubuntu0.9.04.1)
karmic_xulrunner-1.9.1: released (1.9.1~rc2+nobinonly-0ubuntu1)
lucid_xulrunner-1.9.1: DNE
maverick_xulrunner-1.9.1: DNE
natty_xulrunner-1.9.1: DNE
oneiric_xulrunner-1.9.1: DNE
devel_xulrunner-1.9.1: DNE


Patches_seamonkey:
upstream_seamonkey: needs-triage
dapper_seamonkey: DNE
hardy_seamonkey: released (1.1.17+nobinonly-0ubuntu0.8.04.1)
intrepid_seamonkey: released (1.1.17+nobinonly-0ubuntu0.8.10.1)
jaunty_seamonkey: released (1.1.17+nobinonly-0ubuntu0.9.04.1)
karmic_seamonkey: released (1.1.17+nobinonly-0ubuntu1)
lucid_seamonkey: released (1.1.17+nobinonly-0ubuntu1)
maverick_seamonkey: released (1.1.17+nobinonly-0ubuntu1)
natty_seamonkey: released (1.1.17+nobinonly-0ubuntu1)
oneiric_seamonkey: released (1.1.17+nobinonly-0ubuntu1)
devel_seamonkey: released (1.1.17+nobinonly-0ubuntu1)


Patches_thunderbird:
upstream_thunderbird: needs-triage
dapper_thunderbird: DNE
hardy_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu0.8.04.1)
intrepid_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu0.8.10.1)
jaunty_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu0.9.04.1)
karmic_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu1.nspr474)
lucid_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu1.nspr474)
maverick_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu1.nspr474)
natty_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu1.nspr474)
oneiric_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu1.nspr474)
devel_thunderbird: released (2.0.0.22+build1+nobinonly-0ubuntu1.nspr474)

Patches_mozilla-thunderbird:
upstream_mozilla-thunderbird: needs-triage
dapper_mozilla-thunderbird: ignored (reached end-of-life)
hardy_mozilla-thunderbird: DNE
intrepid_mozilla-thunderbird: DNE
jaunty_mozilla-thunderbird: DNE
karmic_mozilla-thunderbird: DNE
lucid_mozilla-thunderbird: DNE
maverick_mozilla-thunderbird: DNE
natty_mozilla-thunderbird: DNE
oneiric_mozilla-thunderbird: DNE
devel_mozilla-thunderbird: DNE