Description
Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header. NOTE: it was later reported that Firefox 3.6 a1 pre and Mozilla 1.7.x and earlier are also affected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | xulrunner | 1.9.0.9-0lenny2 | DSA-1797-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 3.0.9-1.el5 | RHSA-2009:0436 |
| RHEL 5 | xulrunner +2 | 1.9.0.9-1.el5 | RHSA-2009:0436 |
| RHEL 4 | firefox | 3.0.9-1.el4 | RHSA-2009:0436 |
| RHEL 4 | seamonkey +5 | 1.0.9-41.el4 | RHSA-2009:0437 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.37.el3 | RHSA-2009:0437 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.33.el2 | RHSA-2009:0437 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Mozilla (Multiple Products) - Server Refresh Header Cross-Site Scripting EDB-32942 · remote · Apr 22, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2009:0436 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0437 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1797-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- MDVSA-2009:111 vendor-advisory
- FEDORA-2009-3875 vendor-advisory
- 34894 third-party-advisory
- ADV-2009-1125 vdb-entry
- oval:org.mitre.oval:def:9818 vdb-entry signature
- 34758 third-party-advisory
- oval:org.mitre.oval:def:6131 vdb-entry signature
- http://www.mozilla.org/security/announce/2009/mfsa2009-22.html
- http://websecurity.com.ua/3386/
- 1022096 vdb-entry
- oval:org.mitre.oval:def:6064 vdb-entry signature
- 34844 third-party-advisory
- http://ha.ckers.org/blog/20070309/firefox-header-redirection-javascript-execution/
- https://bugzilla.mozilla.org/show_bug.cgi?id=475636
- http://websecurity.com.ua/3275/
- 35065 third-party-advisory
- 20090703 Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome mailing-list
- oval:org.mitre.oval:def:6731 vdb-entry signature
- USN-764-1 vendor-advisory
- SUSE-SR:2009:010 vendor-advisory
- 34656 vdb-entry
- 20090702 Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome mailing-list
- 34843 third-party-advisory
- RHSA-2009:0437 vendor-advisory
- RHSA-2009:0436 vendor-advisory
- 264308 vendor-advisory