CVE-2009-5017
Firefox: overlong UTF-8 seqence detection problem
Severity Score
4.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.
Mozilla Firefox anterior v3.6 Beta 3 no maneja adecuadamente codificaciones UTF-8 demasiado largas, lo que hace facil para atacantes remotos superar los mecanísmos de protección de secuencias de comandos en sitios cruzados (XSS) a través de cadenas manipuladas, una vulnerabilidad diferente que CVE-2010-1210.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2010-11-12 CVE Reserved
- 2010-11-12 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://hg.mozilla.org/releases/mozilla-1.9.2/rev/e42c563313a0 | X_refsource_confirm | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=522634 | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html | 2024-09-16 |
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=511859 | 2010-12-01 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2009-5017 | 2010-06-22 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=656287 | 2010-06-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | <= 3.6 Search vendor "Mozilla" for product "Firefox" and version " <= 3.6" | beta2 |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 3.6 Search vendor "Mozilla" for product "Firefox" and version "3.6" | beta1 |
Affected
| ||||||