Description
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 3.0.6-1.el5 | RHSA-2009:0256 |
| RHEL 5 | nss +3 | 3.12.2.0-4.el5 | RHSA-2009:0256 |
| RHEL 5 | xulrunner +2 | 1.9.0.6-1.el5 | RHSA-2009:0256 |
| RHEL 4 | firefox | 3.0.6-1.el4 | RHSA-2009:0256 |
| RHEL 4 | nss +2 | 3.12.2.0-3.el4 | RHSA-2009:0256 |
| RHEL 4 | seamonkey +5 | 1.0.9-35.el4 | RHSA-2009:0257 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.32.el3 | RHSA-2009:0257 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.27.el2 | RHSA-2009:0257 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 4
- RHSA-2009:0256 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0257 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 33808 third-party-advisory
- ADV-2009-0313 vdb-entry
- SUSE-SA:2009:009 vendor-advisory
- FEDORA-2009-3101 vendor-advisory
- 33809 third-party-advisory
- MDVSA-2009:044 vendor-advisory
- RHSA-2009:0256 vendor-advisory
- SSA:2009-083-02 vendor-advisory
- 1021668 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm
- https://bugzilla.mozilla.org/show_bug.cgi?id=380418
- 33831 third-party-advisory
- USN-717-2 vendor-advisory
- 33841 third-party-advisory
- 34527 third-party-advisory
- 33816 third-party-advisory
- 33846 third-party-advisory
- http://www.mozilla.org/security/announce/2009/mfsa2009-05.html
- 33799 third-party-advisory
- RHSA-2009:0257 vendor-advisory
- oval:org.mitre.oval:def:9459 vdb-entry signature
- 34462 third-party-advisory
- 33598 vdb-entry
- FEDORA-2009-1399 vendor-advisory
- http://ha.ckers.org/blog/20070511/bluehat-errata/
- 33869 third-party-advisory
- USN-717-1 vendor-advisory