NVD

Id
49895  
Name
CVE-2009-2654  
Description
Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-08-03  
Modified Date
2012-10-22  
Seq
2009-2654  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
252201 49895 CVE-2009-2654 http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/  View
252202 49895 CVE-2009-2654 http://es.geocities.com/jplopezy/firefoxspoofing.html  View
252203 49895 CVE-2009-2654 oval:org.mitre.oval:def:9686  View
252204 49895 CVE-2009-2654 266148  View
252205 49895 CVE-2009-2654 DSA-1873  View
252206 49895 CVE-2009-2654 http://www.mozilla.org/security/announce/2009/mfsa2009-44.html  View
252207 49895 CVE-2009-2654 RHSA-2009:1430  View
252208 49895 CVE-2009-2654 RHSA-2009:1431  View
252209 49895 CVE-2009-2654 RHSA-2009:1432  View
252210 49895 CVE-2009-2654 20090724 URL spoofing bug involving Firefox"s error pages and document.write  View
252211 49895 CVE-2009-2654 20090727 Re: URL spoofing bug involving Firefox"s error pages and document.write  View
252212 49895 CVE-2009-2654 35803  View
252213 49895 CVE-2009-2654 1022603  View
252214 49895 CVE-2009-2654 USN-811-1  View
252215 49895 CVE-2009-2654 ADV-2009-2006  View
252216 49895 CVE-2009-2654 ADV-2009-2142  View
252217 49895 CVE-2009-2654 https://bugzilla.mozilla.org/show_bug.cgi?id=451898  View
252218 49895 CVE-2009-2654 FEDORA-2009-8279  View
252219 49895 CVE-2009-2654 FEDORA-2009-8288  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40975 JVNDB-2009-001981 Mozilla Firefox におけるアドレスバーを偽装される脆弱性 Mozilla Firefox には、不正な URL で window.open を呼び出し、その結果のオブジェクトを document.write に呼び出させ、さらにエラーページのロード中に stop メソッドを呼び出すことにより、アドレスバーを偽装可能な脆弱性が存在します。 CVE-2009-2654 40085 CVE-2009-2654 49895 5.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001981.html 2009-08-03 2009-10-01 View