CVE-2009-2472: Fedoraproject Fedora

Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days.

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."

Affected products

• Fedoraproject Fedora: version 10 only
• Mozilla Firefox: before 3.0.12 (fixed in 3.0.12)
• Opensuse Opensuse: version 11.0 only; version 11.1 only
• Suse Linux Enterprise Debuginfo: version 10 only; version 11 only
• Suse Linux Enterprise Desktop: version 10 only; version 11 only
• Suse Linux Enterprise Server: version 10 only; version 11 only

Published 2009-07-22. Last modified 2026-06-16.