{"id":"UBUNTU-CVE-2009-4924","details":"Dan Pascu python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag of a SCRIPT element.","modified":"2025-07-16T07:30:38.865346Z","published":"2010-07-02T19:30:00Z","withdrawn":"2025-07-18T16:42:39Z","upstream":["CVE-2009-4924"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2009-4924"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2009-4924"}],"affected":[{"package":{"name":"python-cjson","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/python-cjson@1.0.5-4build1?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-4build1"}]}],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"python-cjson","binary_version":"1.0.5-4build1"},{"binary_name":"python-cjson-dbg","binary_version":"1.0.5-4build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2009/UBUNTU-CVE-2009-4924.json"}}],"schema_version":"1.7.3","severity":[{"type":"Ubuntu","score":"medium"}]}