PT-2010-1819 · Mozilla+1 · Firefox+1

Sirdarckcat · Published 2010-06-22 · Updated 2010-12-01 · CVE-2009-5017

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6 Beta 3

Description The issue arises from improper handling of overlong UTF-8 encoding, making it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string.

Recommendations For versions prior to 3.6 Beta 3, update to version 3.6 Beta 3 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-5017

RHSA-2010:0500

RHSA-2010:0501

RHSA-2010_0500

RHSA-2010_0501

Affected Products

Firefox

Red Hat

References · 19

• 🔥 http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html · Exploit
• https://bugzilla.mozilla.org/show_bug.cgi?id=511859 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-5017 · Security Note
• https://access.redhat.com/security/cve/CVE-2008-5913 · Note
• https://access.redhat.com/security/cve/CVE-2010-1199 · Note
• https://access.redhat.com/security/cve/CVE-2009-5017 · Note
• https://access.redhat.com/errata/RHSA-2010:0500 · Note
• https://access.redhat.com/security/cve/CVE-2010-0182 · Note
• https://access.redhat.com/security/cve/CVE-2010-1203 · Note
• https://access.redhat.com/security/cve/CVE-2010-1202 · Note
• https://access.redhat.com/security/cve/CVE-2010-1198 · Note
• https://access.redhat.com/security/cve/CVE-2010-1125 · Note
• https://access.redhat.com/security/cve/CVE-2010-1121 · Note
• https://access.redhat.com/errata/RHSA-2010:0501 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=522634 · Note