Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2654 to the following vulnerability: Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page. This issue has already been addressed in Fedora via FEDORA-2009-8279 and FEDORA-2009-8288. References: http://www.mozilla.org/security/announce/2009/mfsa2009-44.html https://bugzilla.mozilla.org/show_bug.cgi?id=451898 http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2009:1430 https://rhn.redhat.com/errata/RHSA-2009-1430.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2009:1431 https://rhn.redhat.com/errata/RHSA-2009-1431.html
This issue has been addressed in following products: Red Hat Enterprise Linux 3 Via RHSA-2009:1432 https://rhn.redhat.com/errata/RHSA-2009-1432.html