CVE-2009-1834

Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

3.23% chance of exploitation in the next 30 days, 88th percentile

Published

2009-06-12

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/33039

Security advisories

• http://secunia.com/advisories/35331
• http://secunia.com/advisories/35431
• http://secunia.com/advisories/35439
• http://www.mozilla.org/security/announce/2009/mfsa2009-25.html
• http://www.vupen.com/english/advisories/2009/1572
• http://www.securityfocus.com/bid/35326
• http://www.securityfocus.com/bid/35388

References

• CVE Record
• NVD entry