CVE-2009-3988

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-02-22 · updated 2026-06-16
Weakness: CWE-264

Description

Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.

Affected products

Mozilla Firefox: through 3.0.17; 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+18)
Mozilla Seamonkey: 2.0, 2.0-alpha_1, 2.0-alpha_2, 2.0-alpha_3, 2.0-beta_1, 2.0-beta_2 (+2)

References

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html
http://secunia.com/advisories/37242
http://secunia.com/advisories/38847
http://www.debian.org/security/2010/dsa-1999
http://www.mandriva.com/security/advisories?name=MDVSA-2010:042
http://www.mozilla.org/security/announce/2010/mfsa2010-04.html
http://www.redhat.com/support/errata/RHSA-2010-0112.html
http://www.ubuntu.com/usn/USN-895-1
http://www.ubuntu.com/usn/USN-896-1

Get alerted when CVE-2009-3988 or the next vulnerability affects your stack