NVD

Id
50580  
Name
CVE-2009-3376  
Description
Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-10-29  
Modified Date
2010-08-21  
Seq
2009-3376  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
255711 50580 CVE-2009-3376 SUSE-SR:2010:013  View
255712 50580 CVE-2009-3376 oval:org.mitre.oval:def:11218  View
255713 50580 CVE-2009-3376 oval:org.mitre.oval:def:6541  View
255714 50580 CVE-2009-3376 272909  View
255715 50580 CVE-2009-3376 MDVSA-2009:294  View
255716 50580 CVE-2009-3376 http://www.mozilla.org/security/announce/2009/mfsa2009-62.html  View
255717 50580 CVE-2009-3376 RHSA-2010:0153  View
255718 50580 CVE-2009-3376 RHSA-2010:0154  View
255719 50580 CVE-2009-3376 USN-915-1  View
255720 50580 CVE-2009-3376 ADV-2009-3334  View
255721 50580 CVE-2009-3376 ADV-2010-0648  View
255722 50580 CVE-2009-3376 ADV-2010-0650  View
255723 50580 CVE-2009-3376 https://bugzilla.mozilla.org/show_bug.cgi?id=511521  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41296 JVNDB-2009-002303 Mozilla Firefox/SeaMonkey における意図しないファイルをダウンロードさせられる脆弱性 Mozilla Firefox/SeaMonkey には、右から左へ書くオーバーライド文字を含むファイル名の処理に不備が存在するため、意図しないファイルをダウンロードさせられる脆弱性が存在します。 CVE-2009-3376 40807 CVE-2009-3376 50580 9.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002303.html 2009-10-27 2010-04-01 View