CVE-2009-1834

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-06-12 · updated 2026-06-16
Weakness: CWE-20

Description

Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.

Affected products

Mozilla Firefox: through 3.0.10; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+94)
Mozilla Seamonkey: through 1.1.16; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.3, 1.0.4 (+20)

References

http://osvdb.org/55162
http://secunia.com/advisories/35331
http://secunia.com/advisories/35415
http://secunia.com/advisories/35431
http://secunia.com/advisories/35439
http://secunia.com/advisories/35468
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1
http://www.debian.org/security/2009/dsa-1820
http://www.mozilla.org/security/announce/2009/mfsa2009-25.html
http://www.securityfocus.com/bid/35326
http://www.securityfocus.com/bid/35388

Get alerted when CVE-2009-1834 or the next vulnerability affects your stack