CVE-2009-1834 Other in n/a
Remote attackers can spoof the browser location bar using invalid Unicode characters in IDN domains, misleading users about the site's true identity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2009-1834?
CVE-2009-1834 is a medium-severity vulnerability in Mozilla Firefox, published on 12 Jun 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
Weakness: CWE-20
Which versions are affected by CVE-2009-1834?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Seamonkey.
How do I fix CVE-2009-1834?
Upgrade to a fixed version.
Is CVE-2009-1834 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-1834 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-m6fm-xwqg-f4r6.