CVE-2009-3385 Information disclosure in n/a

High 7.1 Published 22 Mar 2010 Updated 7 Aug 2024

Attackers can steal local files via crafted HTML emails in SeaMonkey, requiring user interaction to view the message.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2009-3385?

CVE-2009-3385 is a high-severity vulnerability in Mozilla Seamonkey, published on 22 Mar 2010. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation.

Weakness: CWE-264

Which versions are affected by CVE-2009-3385?

It affects 1 product.

Products include Mozilla Seamonkey.

How do I fix CVE-2009-3385?

Upgrade to a fixed version.

Is CVE-2009-3385 being exploited?

There is no known exploitation of CVE-2009-3385 in the wild and no public exploit code.

All Mozilla Seamonkey vulnerabilities

Sources

Also known as GHSA-wj9q-fjc4-6whp.