CVE ID:	CVE-2009-3988
Description:	Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.
Test IDs:	1.3.6.1.4.1.25623.1.0.66939   1.3.6.1.4.1.25623.1.0.66941   1.3.6.1.4.1.25623.1.0.66948   1.3.6.1.4.1.25623.1.0.66951
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3988 Debian Security Information: DSA-1999 (Google Search) http://www.debian.org/security/2010/dsa-1999 http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:042 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8355 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9384 RedHat Security Advisories: RHSA-2010:0112 http://www.redhat.com/support/errata/RHSA-2010-0112.html http://secunia.com/advisories/37242 http://secunia.com/advisories/38847 SuSE Security Announcement: SUSE-SA:2010:015 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html http://www.ubuntu.com/usn/USN-895-1 http://www.ubuntu.com/usn/USN-896-1 http://www.vupen.com/english/advisories/2010/0405 XForce ISS Database: mozilla-showmodaldialog-xss(56362) https://exchange.xforce.ibmcloud.com/vulnerabilities/56362