PT-2009-4299 · Mozilla+1 · Firefox+2

Pavel Cvrcek · Publicado 2009-06-11 · Atualizado 2018-10-30 · CVE-2009-1834

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 3.0.11 SeaMonkey versions prior to 1.1.17

Description: A visual truncation issue allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace. This can be achieved by using specific Unicode characters, such as u115A through u115E, which are displayed as whitespace.

Recommendations: For Mozilla Firefox versions prior to 3.0.11, update to version 3.0.11 or later to resolve the issue. For SeaMonkey versions prior to 1.1.17, update to version 1.1.17 or later to resolve the issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-1834

DSA-1820-1

RHSA-2009:1095

RHSA-2009_1095

Produtos afetados

Firefox

Red Hat

Seamonkey

Referências · 55

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=479413 · Exploit
• 🔥 https://exploit-db.com/exploits/33039 · Exploit
• https://bugzilla.mozilla.org/show_bug.cgi?id=489041 · Nota
• http://secunia.com/advisories/35415 · Nota
• https://access.redhat.com/errata/RHSA-2009:1095 · Nota
• https://access.redhat.com/security/cve/CVE-2009-1840 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=503576 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-June/msg00657.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=503573 · Nota
• https://access.redhat.com/security/cve/CVE-2009-1836 · Nota
• https://access.redhat.com/security/cve/CVE-2009-1839 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=490513 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=503568 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=427196 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=479880 · Nota