What’s Vulnerable › Vulnerabilities

CVE-2009-2654

• Severity: medium (CVSS 5.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2009-08-03 · updated 2026-06-16
• Weakness: CWE-20

Description

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.

Affected products

• Mozilla Firefox: through 3.5.1; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+101)

References

• http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/
• http://es.geocities.com/jplopezy/firefoxspoofing.html
• http://osvdb.org/56717
• http://secunia.com/advisories/36001
• http://secunia.com/advisories/36126
• http://secunia.com/advisories/36141
• http://secunia.com/advisories/36435
• http://secunia.com/advisories/36669
• http://secunia.com/advisories/36670
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1
• http://www.debian.org/security/2009/dsa-1873
• http://www.mozilla.org/security/announce/2009/mfsa2009-44.html

Get alerted when CVE-2009-2654 or the next vulnerability affects your stack