Description
Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | xulrunner | 1.9.0.13-0lenny1 | DSA-1873-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 3.0.14-1.el5_4 | RHSA-2009:1430 |
| RHEL 5 | nspr +1 | 4.7.5-1.el5_4 | RHSA-2009:1430 |
| RHEL 5 | xulrunner +2 | 1.9.0.14-1.el5_4 | RHSA-2009:1430 |
| RHEL 4 | firefox | 3.0.14-1.el4 | RHSA-2009:1430 |
| RHEL 4 | nspr +1 | 4.7.5-1.el4_8 | RHSA-2009:1430 |
| RHEL 4 | seamonkey +5 | 1.0.9-48.el4_8 | RHSA-2009:1431 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.45.el3 | RHSA-2009:1432 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Mozilla Firefox 3.5.1 - Error Page Address Bar URI Spoofing EDB-33103 · remote · Jun 24, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2009:1432 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1430 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1431 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1873-1 xulrunner - spoofing vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- ADV-2009-2142 vdb-entry
- 36141 third-party-advisory
- ADV-2009-2006 vdb-entry
- 20090727 Re: URL spoofing bug involving Firefox's error pages and document.write mailing-list
- RHSA-2009:1430 vendor-advisory
- http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/
- 266148 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=451898
- 36001 third-party-advisory
- USN-811-1 vendor-advisory
- 35803 vdb-entry
- 36670 third-party-advisory
- 36669 third-party-advisory
- oval:org.mitre.oval:def:9686 vdb-entry signature
- FEDORA-2009-8288 vendor-advisory
- 36126 third-party-advisory
- RHSA-2009:1432 vendor-advisory
- http://www.mozilla.org/security/announce/2009/mfsa2009-44.html
- FEDORA-2009-8279 vendor-advisory
- 20090724 URL spoofing bug involving Firefox's error pages and document.write mailing-list
- 56717 vdb-entry
- 1022603 vdb-entry
- http://es.geocities.com/jplopezy/firefoxspoofing.html
- DSA-1873 vendor-advisory
- RHSA-2009:1431 vendor-advisory
- 36435 third-party-advisory