CVE-2009-0777

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-03-05 · updated 2026-06-16
Weakness: CWE-20

Description

Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed in the location bar, which causes an incorrect address to be displayed and makes it easier for remote attackers to spoof URLs and conduct phishing attacks.

Affected products

Mozilla Firefox: through 3.0.6; 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 (+43)
Mozilla Seamonkey: through 1.1.14; 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.5, 1.0.6 (+19)
Mozilla Thunderbird: through 2.0.0.20; 2.0.0.0, 2.0.0.4, 2.0.0.5, 2.0.0.6, 2.0.0.9, 2.0.0.12 (+5)

References

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html
http://secunia.com/advisories/34140
http://secunia.com/advisories/34145
http://secunia.com/advisories/34272
http://securitytracker.com/alerts/2009/Mar/1021799.html
http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm
http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document
http://www.mandriva.com/security/advisories?name=MDVSA-2009:075
http://www.mozilla.org/security/announce/2009/mfsa2009-11.html
http://www.redhat.com/support/errata/RHSA-2009-0315.html
http://www.securityfocus.com/bid/33990
http://www.vupen.com/english/advisories/2009/0632

Get alerted when CVE-2009-0777 or the next vulnerability affects your stack