CVE-2009-3385

The mail component in Mozilla SeaMonkey before 1.1.19 does not properly restrict execution of scriptable plugin content, which allows user-assisted remote attackers to obtain sensitive information via crafted content in an IFRAME element in an HTML e-mail message, as demonstrated by a Flash object that sends arbitrary local files during a reply or forward operation.

• CWE-264

• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
• http://secunia.com/advisories/39001Vendor Advisory
• http://www.mozilla.org/security/announce/2010/mfsa2010-06.htmlVendor Advisory
• http://www.securityfocus.com/bid/38830
• http://www.vupen.com/english/advisories/2010/0648Patch, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=371976
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10271
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
• http://secunia.com/advisories/39001Vendor Advisory
• http://www.mozilla.org/security/announce/2010/mfsa2010-06.htmlVendor Advisory
• http://www.securityfocus.com/bid/38830
• http://www.vupen.com/english/advisories/2010/0648Patch, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=371976
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10271

Published

Mar 23, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3379Multiple unspecified vulnerabilities in libvorbis, as used i…
• CVE-2009-3380Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2009-3381Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2009-3382layout/base/nsCSSFrameConstructor.cpp in the browser engine …
• CVE-2009-3383Multiple unspecified vulnerabilities in the JavaScript engin…
• CVE-2009-3384Multiple unspecified vulnerabilities in WebKit in Apple Safa…
• CVE-2009-3386Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through …
• CVE-2009-3387Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allo…
• CVE-2009-3388liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonk…
• CVE-2009-3389Integer overflow in libtheora in Xiph.Org Theora before 1.1,…
• CVE-2009-3390Multiple unspecified vulnerabilities in the (1) iscsiadm and…
• CVE-2009-3392Unspecified vulnerability in the Agile Engineering Data Mana…