PT-2009-5683 · Mozilla+1 · Firefox+2

Geekboy Or Sstamm

+1

·

Published

2009-10-27

·

Updated

2024-12-12

·

CVE-2009-3376

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.15 Mozilla Firefox versions 3.5.x prior to 3.5.4 SeaMonkey versions prior to 2.0
Description The issue arises from improper handling of a right-to-left override (RLO or U+202E) Unicode character in a download filename. This allows remote attackers to spoof file extensions via a crafted filename. For example, it can display a non-executable extension for an executable file.
Recommendations For Mozilla Firefox versions prior to 3.0.15, update to version 3.0.15 or later. For Mozilla Firefox versions 3.5.x prior to 3.5.4, update to version 3.5.4 or later. For SeaMonkey versions prior to 2.0, update to version 2.0 or later.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2009-3376
DSA-1922-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
RHSA-2009:1530
RHSA-2009:1531
RHSA-2009_1530
RHSA-2009_1531
RHSA-2010:0153
RHSA-2010:0154
RHSA-2010_0153
RHSA-2010_0154

Affected Products

Firefox
Red Hat
Seamonkey