CVE-2009-1834

Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.

• CWE-20

• http://osvdb.org/55162
• http://secunia.com/advisories/35331Vendor Advisory
• http://secunia.com/advisories/35415
• http://secunia.com/advisories/35431Vendor Advisory
• http://secunia.com/advisories/35439Vendor Advisory
• http://secunia.com/advisories/35468
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1
• http://www.debian.org/security/2009/dsa-1820
• http://www.mozilla.org/security/announce/2009/mfsa2009-25.htmlVendor Advisory
• http://www.securityfocus.com/bid/35326
• http://www.securityfocus.com/bid/35388
• http://www.vupen.com/english/advisories/2009/1572Patch, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=479413Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=503573
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10436
• https://rhn.redhat.com/errata/RHSA-2009-1095.html
• https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html
• https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html
• http://osvdb.org/55162
• http://secunia.com/advisories/35331Vendor Advisory
• http://secunia.com/advisories/35415
• http://secunia.com/advisories/35431Vendor Advisory
• http://secunia.com/advisories/35439Vendor Advisory
• http://secunia.com/advisories/35468
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1
• http://www.debian.org/security/2009/dsa-1820
• http://www.mozilla.org/security/announce/2009/mfsa2009-25.htmlVendor Advisory
• http://www.securityfocus.com/bid/35326
• http://www.securityfocus.com/bid/35388
• http://www.vupen.com/english/advisories/2009/1572Patch, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=479413Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=503573
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10436
• https://rhn.redhat.com/errata/RHSA-2009-1095.html
• https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html
• https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html

Published

Jun 12, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1828Mozilla Firefox 3.0.10 allows remote attackers to cause a de…
• CVE-2009-1829Unspecified vulnerability in the PCNFSD dissector in Wiresha…
• CVE-2009-1830Stack-based buffer overflow in Soulseek 156 and 157 NS allow…
• CVE-2009-1831The Nullsoft Modern Skins Support module (gen_ff.dll) in Nul…
• CVE-2009-1832Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, …
• CVE-2009-1833The JavaScript engine in Mozilla Firefox before 3.0.11, Thun…
• CVE-2009-1835Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 as…
• CVE-2009-1836Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, …
• CVE-2009-1837Race condition in the NPObjWrapper_NewResolve function in mo…7.5
• CVE-2009-1838The garbage-collection implementation in Mozilla Firefox bef…
• CVE-2009-1839Mozilla Firefox 3 before 3.0.11 associates an incorrect prin…
• CVE-2009-1840Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do…