Bug 521311 (CVE-2009-2654)

Summary:	CVE-2009-2654 firefox: URL bar spoofing vulnerability
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gecko-bugs-nobody, mjc, tao
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2654
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-06-10 21:21:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2009-09-04 17:42:30 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2654 to
the following vulnerability:

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page. 

This issue has already been addressed in Fedora via FEDORA-2009-8279 and FEDORA-2009-8288.

References:

http://www.mozilla.org/security/announce/2009/mfsa2009-44.html
https://bugzilla.mozilla.org/show_bug.cgi?id=451898
http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/

Comment 1 errata-xmlrpc 2009-09-09 23:27:58 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:1430 https://rhn.redhat.com/errata/RHSA-2009-1430.html

Comment 2 errata-xmlrpc 2009-09-09 23:50:03 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1431 https://rhn.redhat.com/errata/RHSA-2009-1431.html

Comment 3 errata-xmlrpc 2009-09-09 23:50:45 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 3

Via RHSA-2009:1432 https://rhn.redhat.com/errata/RHSA-2009-1432.html