CVE-2009-3987

Mozilla GeckoActiveXObject exception messages can be used to enumerate installed COM objects

Published Dec 17, 2009 CVSS 2.0 · 7.8 High EPSS 1.6% KEV · Not listed
Description
The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2009-3958 The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects.
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 6:45 AM
Reserved
Nov 19, 2009, 12:00 AM
Status
Modified
Published
Dec 17, 2009, 5:30 PM
Modified
Jun 16, 2026, 11:12 PM
Severity
Low
Public date
Dec 15, 2009, 12:00 AM