Description
Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has already been saved on the local system.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | devhelp +1 | 0.12-20.el5 | RHSA-2008:0978 |
| RHEL 5 | firefox | 3.0.4-1.el5 | RHSA-2008:0978 |
| RHEL 5 | nss +3 | 3.12.1.1-3.el5 | RHSA-2008:0978 |
| RHEL 5 | xulrunner +2 | 1.9.0.4-1.el5 | RHSA-2008:0978 |
| RHEL 5 | yelp | 2.16.0-22.el5 | RHSA-2008:0978 |
| RHEL 4 | firefox | 3.0.4-1.el4 | RHSA-2008:0978 |
| RHEL 4 | nss +1 | 3.12.1.1-3.el4 | RHSA-2008:0978 |
Advisories 1
- RHSA-2008:0978 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- ADV-2008-3146 vdb-entry
- oval:org.mitre.oval:def:11063 vdb-entry signature
- 1021191 vdb-entry
- 32281 vdb-entry
- 32713 third-party-advisory
- MDVSA-2008:230 vendor-advisory
- ADV-2009-0977 vdb-entry
- 32695 third-party-advisory
- RHSA-2008:0978 vendor-advisory
- 32778 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=447579
- FEDORA-2008-9669 vendor-advisory
- 256408 vendor-advisory
- SUSE-SA:2008:055 vendor-advisory
- 32721 third-party-advisory
- TA08-319A third-party-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-51.html
- USN-667-1 vendor-advisory
- 34501 third-party-advisory