--- title: "CVE-2009-3988\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2009-3988?format=md keywords: index, follow --- # CVE-2009-3988 Publication date 17 February 2010 Last updated 24 July 2024 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | firefox | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not in release | | 9.04 jaunty | Not in release | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Not affected | | 6.06 LTS dapper | Ignored end of life | | mozilla-thunderbird | 10.04 LTS lucid | Not in release | | 9.10 karmic | Not in release | | 9.04 jaunty | Not in release | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Ignored end of life | | seamonkey | 10.04 LTS lucid | Fixed 2.0.8+build1+nobinonly-0ubuntu0.10.04.1 | | 9.10 karmic | Fixed 2.0.8+build1+nobinonly-0ubuntu0.9.10.1 | | 9.04 jaunty | Fixed 2.0.8+build1+nobinonly-0ubuntu0.9.04.1 | | 8.10 intrepid | Ignored end of life, was needed | | 8.04 LTS hardy | Fixed 2.0.8+build1+nobinonly-0ubuntu0.8.04.1 | | 6.06 LTS dapper | Not in release | | thunderbird | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not affected | | 9.04 jaunty | Not affected | | 8.10 intrepid | Not affected | | 8.04 LTS hardy | Not affected | | 6.06 LTS dapper | Not in release | | xulrunner-1.9 | 10.04 LTS lucid | Not in release | | 9.10 karmic | Not in release | | 9.04 jaunty | Fixed 1.9.0.18+build1+nobinonly-0ubuntu0.9.04.1 | | 8.10 intrepid | Fixed 1.9.0.18+build1+nobinonly-0ubuntu0.8.10.1 | | 8.04 LTS hardy | Fixed 1.9.0.18+build1+nobinonly-0ubuntu0.8.04.1 | | 6.06 LTS dapper | Not in release | | xulrunner-1.9.1 | 10.04 LTS lucid | Not in release | | 9.10 karmic | Fixed 1.9.1.8+build1+nobinonly-0ubuntu0.9.10.1 | | 9.04 jaunty | Fixed 1.9.1.8+build1+nobinonly-0ubuntu0.9.04.1 | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3988) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2009-3988) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2009-3988) * [Debian](https://security-tracker.debian.org/tracker/CVE-2009-3988) ### Related Ubuntu Security Notices (USN) + [USN-896-1](https://usn.ubuntu.com/USN-896-1) + Firefox 3.5 and Xulrunner 1.9.1 vulnerabilities + 17 February 2010 + [USN-895-1](https://usn.ubuntu.com/USN-895-1) + Firefox 3.0 and Xulrunner 1.9 vulnerabilities + 17 February 2010 ### Other references * *