CVE-2009-2654

Published: Aug 3, 2009Modified: Apr 23, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.

Affected (108)

Products: Mozilla: Firefox

Mozilla

1 product

Firefox

Configuration A

108 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.5.1
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.1
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.3
Mozilla Firefox	Version 0.4
Mozilla Firefox	Version 0.5
Mozilla Firefox	Version 0.6.1
Mozilla Firefox	Version 0.6
Mozilla Firefox	Version 0.7.1
Mozilla Firefox	Version 0.7
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 0.9_rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.0 preview_release
Mozilla Firefox	Version 1.4.1
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 1.8
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.17
Mozilla Firefox	Version 2.0.0.18
Mozilla Firefox	Version 2.0.0.19
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.20
Mozilla Firefox	Version 2.0.0.21
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta1
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3
Mozilla Firefox	Version 2.0_.10
Mozilla Firefox	Version 2.0_.1
Mozilla Firefox	Version 2.0_.4
Mozilla Firefox	Version 2.0_.5
Mozilla Firefox	Version 2.0_.6
Mozilla Firefox	Version 2.0_.7
Mozilla Firefox	Version 2.0_.9
Mozilla Firefox	Version 2.0_8
Mozilla Firefox	Version 3.0.10
Mozilla Firefox	Version 3.0.11
Mozilla Firefox	Version 3.0.12
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0.6
Mozilla Firefox	Version 3.0.7
Mozilla Firefox	Version 3.0.8
Mozilla Firefox	Version 3.0.9
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.0 beta2
Mozilla Firefox	Version 3.0 beta5
Mozilla Firefox	Version 3.1 beta1
Mozilla Firefox	Version 3.2 beta1
Mozilla Firefox	Version 3.2 beta2
Mozilla Firefox	Version 3.2 beta3
Mozilla Firefox	Version 3.5

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (52)

http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/

Source: cve@mitre.org

PatchVendor Advisory

http://es.geocities.com/jplopezy/firefoxspoofing.html

Source: cve@mitre.org

http://osvdb.org/56717

Source: cve@mitre.org

http://secunia.com/advisories/36001

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36126

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36141

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36435

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36669

Source: cve@mitre.org

http://secunia.com/advisories/36670

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1873

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2009/mfsa2009-44.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2009-1430.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-1431.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-1432.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/505242/30/0/threaded

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/505265

Source: cve@mitre.org

http://www.securityfocus.com/bid/35803

Source: cve@mitre.org

ExploitPatch

http://www.securitytracker.com/id?1022603

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/2006

Source: cve@mitre.org

PatchVendor Advisory

http://www.vupen.com/english/advisories/2009/2142

Source: cve@mitre.org

PatchVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=451898

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9686

Source: cve@mitre.org

https://usn.ubuntu.com/811-1/

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00198.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00261.html

Source: cve@mitre.org

http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/