CVE catalog

CVE-2009-3983

xulrunner - several vulnerabilities

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.20% · Oct 27, 2026

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to arbitrary applications by replaying the NTLM credentials of a browser user.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxulrunner5.01.9.0.10-1vulnerable
Debianxulrunner5.01.9.0.11-0lenny1vulnerable
Debianxulrunner5.01.9.0.11-1vulnerable
Debianxulrunner5.01.9.0.12-0lenny1vulnerable
Debianxulrunner5.01.9.0.12-1vulnerable
Debianxulrunner5.01.9.0.13-0lenny1vulnerable
Debianxulrunner5.01.9.0.13-1vulnerable
Debianxulrunner5.01.9.0.14-0lenny1vulnerable
Debianxulrunner5.01.9.0.14-1vulnerable
Debianxulrunner5.01.9.0.15-0lenny1vulnerable
Debianxulrunner5.01.9.0.5-1vulnerable
Debianxulrunner5.01.9.0.6-1vulnerable
Debianxulrunner5.01.9.0.7-0lenny1vulnerable
Debianxulrunner5.01.9.0.7-0lenny2vulnerable
Debianxulrunner5.01.9.0.7-1vulnerable
Debianxulrunner5.01.9.0.8-1vulnerable
Debianxulrunner5.01.9.0.9-0lenny2vulnerable
Debianxulrunner5.01.9.0.9-1vulnerable
Debianxulrunner5.01.9.0.16-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxulrunnerdeb5.01.9.0.16-1Not reportedDSA-1956-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]