CVE-2009-1307

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-04-22 · updated 2026-06-16
Weakness: CWE-20

Description

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI.

Affected products

Mozilla Firefox: through 3.0.8; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+84)
Mozilla Seamonkey: all versions
Mozilla Thunderbird: all versions

References

http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
http://rhn.redhat.com/errata/RHSA-2009-0437.html
http://secunia.com/advisories/34758
http://secunia.com/advisories/34780
http://secunia.com/advisories/34843
http://secunia.com/advisories/34844
http://secunia.com/advisories/34894
http://secunia.com/advisories/35042
http://secunia.com/advisories/35065
http://secunia.com/advisories/35536
http://secunia.com/advisories/35561
http://secunia.com/advisories/35602

Get alerted when CVE-2009-1307 or the next vulnerability affects your stack