CVE-2009-3987

no score yetEPSS 1.6%

The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects.

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2009-12-17
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox
mozilla:seamonkey

References

http://secunia.com/advisories/37699
http://secunia.com/advisories/37785
http://securitytracker.com/id?1023346
http://securitytracker.com/id?1023347
http://www.mozilla.org/security/announce/2009/mfsa2009-71.html

Check your stack JSON