What’s Vulnerable › Vulnerabilities

CVE-2009-2472

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-07-22 · updated 2026-06-16
• Weakness: CWE-79

Description

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."

Affected products

• Fedoraproject Fedora: 10
• Mozilla Firefox: before 3.0.12 — fixed in 3.0.12
• Opensuse: 11.0, 11.1
• SUSE Linux Enterprise Debuginfo: 10-sp2, 11
• SUSE Linux Enterprise Server 15 SP1: 10-sp2, 11
• SUSE Linux Enterprise Server: 10-sp2, 11

How to fix

Upgrade to a fixed version: Mozilla Firefox 3.0.12. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html
• http://rhn.redhat.com/errata/RHSA-2009-1162.html
• http://secunia.com/advisories/35914
• http://secunia.com/advisories/35944
• http://secunia.com/advisories/36005
• http://secunia.com/advisories/36145
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1
• http://www.mozilla.org/security/announce/2009/mfsa2009-40.html
• http://www.securityfocus.com/bid/35758
• http://www.vupen.com/english/advisories/2009/1972

Get alerted when CVE-2009-2472 or the next vulnerability affects your stack