CVE-2009-2654

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.

• CWE-20

• http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/Patch, Vendor Advisory
• http://es.geocities.com/jplopezy/firefoxspoofing.html
• http://osvdb.org/56717
• http://secunia.com/advisories/36001Vendor Advisory
• http://secunia.com/advisories/36126Vendor Advisory
• http://secunia.com/advisories/36141Vendor Advisory
• http://secunia.com/advisories/36435Vendor Advisory
• http://secunia.com/advisories/36669
• http://secunia.com/advisories/36670
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1
• http://www.debian.org/security/2009/dsa-1873
• http://www.mozilla.org/security/announce/2009/mfsa2009-44.htmlPatch, Vendor Advisory
• http://www.redhat.com/support/errata/RHSA-2009-1430.html
• http://www.redhat.com/support/errata/RHSA-2009-1431.html
• http://www.redhat.com/support/errata/RHSA-2009-1432.html
• http://www.securityfocus.com/archive/1/505242/30/0/threadedExploit
• http://www.securityfocus.com/archive/1/505265
• http://www.securityfocus.com/bid/35803Exploit, Patch
• http://www.securitytracker.com/id?1022603
• http://www.vupen.com/english/advisories/2009/2006Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2142Patch, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=451898
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9686
• https://usn.ubuntu.com/811-1/
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00198.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00261.html
• http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/Patch, Vendor Advisory
• http://es.geocities.com/jplopezy/firefoxspoofing.html
• http://osvdb.org/56717
• http://secunia.com/advisories/36001Vendor Advisory
• http://secunia.com/advisories/36126Vendor Advisory
• http://secunia.com/advisories/36141Vendor Advisory
• http://secunia.com/advisories/36435Vendor Advisory
• http://secunia.com/advisories/36669
• http://secunia.com/advisories/36670
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1
• http://www.debian.org/security/2009/dsa-1873
• http://www.mozilla.org/security/announce/2009/mfsa2009-44.htmlPatch, Vendor Advisory
• http://www.redhat.com/support/errata/RHSA-2009-1430.html
• http://www.redhat.com/support/errata/RHSA-2009-1431.html
• http://www.redhat.com/support/errata/RHSA-2009-1432.html
• http://www.securityfocus.com/archive/1/505242/30/0/threadedExploit
• http://www.securityfocus.com/archive/1/505265
• http://www.securityfocus.com/bid/35803Exploit, Patch
• http://www.securitytracker.com/id?1022603
• http://www.vupen.com/english/advisories/2009/2006Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2009/2142Patch, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=451898
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9686
• https://usn.ubuntu.com/811-1/
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00198.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00261.html

Published

Aug 3, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2648FlashDen Guestbook allows remote attackers to obtain configu…
• CVE-2009-2649The IATA (ata) driver in FreeBSD 6.0 and 8.0, when read acce…
• CVE-2009-2650Heap-based buffer overflow in Sorcerer Software MultiMedia J…
• CVE-2009-2651main/rtp.c in Asterisk Open Source 1.6.1 before 1.6.1.2 allo…
• CVE-2009-2652Unspecified vulnerability in Solaris Trusted Extensions in S…
• CVE-2009-2653The NtUserConsoleControl function in win32k.sys in Microsoft…
• CVE-2009-2655mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows…
• CVE-2009-2656Unspecified vulnerability in the com.android.phone process i…
• CVE-2009-2657nilfs-utils before 2.0.14 installs multiple programs with un…
• CVE-2009-2658Directory traversal vulnerability in ZNC before 0.072 allows…
• CVE-2009-2659The Admin media handler in core/servers/basehttp.py in Djang…
• CVE-2009-2660Multiple integer overflows in CamlImages 2.2 might allow con…