CVE-2009-2654

CVE Details

Release Date:

2009-08-03

Description

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page. Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654.

See more information about CVE-2009-2654 from MITRE CVE dictionary and NIST NVD

CVSS v2.0 metrics

NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.

Base Score:	5.8	Base Metrics:	AV:N/AC:M/Au:N/C:N/I:P/A:P
Access Vector:	Network	Attack Complexity:	Medium
Authentication:	None required	Confidentiality Impact:	None
Integrity Impact:	Partial	Availability Impact:	Partial

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 4 (firefox)	ELSA-2009-1430	2009-09-10
Oracle Enterprise Linux version 4 (nspr)	ELSA-2009-1430	2009-09-10
Oracle Enterprise Linux version 4 (seamonkey)	ELSA-2009-1431	2009-09-10
Oracle Linux version 5 (firefox)	ELSA-2009-1430	2009-09-10
Oracle Linux version 5 (nspr)	ELSA-2009-1430	2009-09-10
Oracle Linux version 5 (xulrunner)	ELSA-2009-1430	2009-09-10

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team