CVE:CVE-2009-3014
CNNVD:CNNVD-200908-489
Mozilla Firefox 3.0.13及之前版本，3.5，3.6 a1 pre和3.7 a1 pre；SeaMonkey 1.1.17和Mozilla 1.7.x及之前版本没有在WEB服务器发送的302错误文档范围内正确的处理HTML链接中的javascript，这使得用户协助式远程攻击者可以借助一些向量，执行跨站脚本攻击。这些向量涉及(1)注入一个Location HTTP响应头或(2)详细说明一个Location HTTP响应头的内容。
solution:Upgrade mozilla firefox to a higher version than 3.0.13,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,3.0.7,3.0.8,3.0.9,3.0.10,3.0.11,3.0.12,3.5,3.6:a1_pre,3.7:a1_pre,and avoid the version (,3.0.13],3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,3.0.7,3.0.8,3.0.9,3.0.10,3.0.11,3.0.12,3.5,3.6:a1_pre,3.7:a1_pre; Upgrade mozilla mozilla to a higher version than 1.7,0.8,0.9.2,0.9.2.1,0.9.3,0.9.4,0.9.4.1,0.9.5,0.9.6,0.9.7,0.9.8,0.9.9,0.9.35,0.9.48,1.0,1.0:rc1,1.0:rc2,1.0:rc3,1.0.1,1.0.2,1.1,1.1:alpha,1.1:beta,1.2,1.2:alpha,1.2:beta,1.2.1,1.3,1.3.1,1.4,1.4:alpha,1.4:beta,1.4.1,1.4.2,1.4.4,1.5,1.5:alpha,1.5:rc1,1.5:rc2,1.5.1,1.6,1.6:alpha,1.6:beta,and avoid the version (,1.7],0.8,0.9.2,0.9.2.1,0.9.3,0.9.4,0.9.4.1,0.9.5,0.9.6,0.9.7,0.9.8,0.9.9,0.9.35,0.9.48,1.0,1.0:rc1,1.0:rc2,1.0:rc3,1.0.1,1.0.2,1.1,1.1:alpha,1.1:beta,1.2,1.2:alpha,1.2:beta,1.2.1,1.3,1.3.1,1.4,1.4:alpha,1.4:beta,1.4.1,1.4.2,1.4.4,1.5,1.5:alpha,1.5:rc1,1.5:rc2,1.5.1,1.6,1.6:alpha,1.6:beta; Upgrade mozilla seamonkey to a higher version than 1.1.17,and avoid the version 1.1.17