CVE-2009-2654 Other in n/a
Remote attackers can spoof the address bar in Firefox via crafted web pages, facilitating phishing attacks by deceiving users about the current site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2009-2654?
CVE-2009-2654 is a medium-severity vulnerability in Mozilla Firefox, published on 3 Aug 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.
Weakness: CWE-20
Which versions are affected by CVE-2009-2654?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2009-2654?
Upgrade to a fixed version.
Is CVE-2009-2654 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-2654 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-4h5h-76c6-8744.