PT-2009-5683 · Mozilla+1 · Firefox+2

Geekboy Or Sstamm

+1

·

Publicado

2009-10-27

·

Atualizado

2024-12-12

·

CVE-2009-3376

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.15 Mozilla Firefox versions 3.5.x prior to 3.5.4 SeaMonkey versions prior to 2.0
Description The issue arises from improper handling of a right-to-left override (RLO or U+202E) Unicode character in a download filename. This allows remote attackers to spoof file extensions via a crafted filename. For example, it can display a non-executable extension for an executable file.
Recommendations For Mozilla Firefox versions prior to 3.0.15, update to version 3.0.15 or later. For Mozilla Firefox versions 3.5.x prior to 3.5.4, update to version 3.5.4 or later. For SeaMonkey versions prior to 2.0, update to version 2.0 or later.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2009-3376
DSA-1922-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
RHSA-2009:1530
RHSA-2009:1531
RHSA-2009_1530
RHSA-2009_1531
RHSA-2010:0153
RHSA-2010:0154
RHSA-2010_0153
RHSA-2010_0154

Produtos afetados

Firefox
Red Hat
Seamonkey