CVE-2009-1834
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0...
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
Exploit likelihood
What each source reports
NVD Score used
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
- Record
CVE-2009-1834- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
- Record
CVE-2009-1834- Updated
- 2026-11-02
EUVDEUVD-2009-1829 No score
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
- Record
EUVD-2009-1829- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m6fm-xwqg-f4r6 No score
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0...
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
- Record
GHSA-m6fm-xwqg-f4r6- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xulrunnerDebian:5.0 From an advisory covering 12 CVEs |
before 1.9.0.11-0lenny1, plus listed versions 1.9.0.10-11.9.0.5-11.9.0.6-11.9.0.7-0lenny11.9.0.7-0lenny2 Show 4 moreShow less1.9.0.7-11.9.0.8-11.9.0.9-0lenny21.9.0.9-1 |
1.9.0.11-0lenny1 |
firefoxRed Hat:enterprise_linux:4::as From an advisory covering 11 CVEs |
before 0:3.0.11-4.el4 | 0:3.0.11-4.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 11 CVEs |
before 0:3.0.11-4.el4 | 0:3.0.11-4.el4 |
firefoxRed Hat:enterprise_linux:4::desktop From an advisory covering 11 CVEs |
before 0:3.0.11-4.el4 | 0:3.0.11-4.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 11 CVEs |
before 0:3.0.11-4.el4 | 0:3.0.11-4.el4 |
firefoxRed Hat:enterprise_linux:4::es From an advisory covering 11 CVEs |
before 0:3.0.11-4.el4 | 0:3.0.11-4.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 11 CVEs |
before 0:3.0.11-4.el4 | 0:3.0.11-4.el4 |
firefoxRed Hat:enterprise_linux:4::ws From an advisory covering 11 CVEs |
before 0:3.0.11-4.el4 | 0:3.0.11-4.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 11 CVEs |
before 0:3.0.11-4.el4 | 0:3.0.11-4.el4 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
xulrunner-devel-unstableRed Hat:enterprise_linux:5::client_workstation From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
firefoxRed Hat:enterprise_linux:5::client From an advisory covering 11 CVEs |
before 0:3.0.11-2.el5_3 | 0:3.0.11-2.el5_3 |
firefox-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 11 CVEs |
before 0:3.0.11-2.el5_3 | 0:3.0.11-2.el5_3 |
xulrunnerRed Hat:enterprise_linux:5::client From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
firefoxRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:3.0.11-2.el5_3 | 0:3.0.11-2.el5_3 |
firefox-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:3.0.11-2.el5_3 | 0:3.0.11-2.el5_3 |
xulrunnerRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
xulrunner-develRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
xulrunner-devel-unstableRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:1.9.0.11-3.el5_3 | 0:1.9.0.11-3.el5_3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing | 2009-05-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1834 is a medium vulnerability (CVSS 4.3) in Mozilla Firefox, published June 12, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.23%, the 88th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2009/1572
securityfocus.com/bid/35388
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10436
mozilla.org/security/announce/2009/mfsa2009-25.html
redhat.com/archives/fedora-package-announce/2009-June/msg00657.html
Show 62 moreShow less
secunia.com/advisories/35431
rhn.redhat.com/errata/RHSA-2009-1095.html
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468
osvdb.org/55162
bugzilla.mozilla.org/show_bug.cgi?id=479413
debian.org/security/2009/dsa-1820
sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1
bugzilla.redhat.com/show_bug.cgi?id=503573
nvd.nist.gov/vuln/detail/CVE-2009-1834
github.com/advisories/GHSA-m6fm-xwqg-f4r6
access.redhat.com/errata/RHSA-2009:1095
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1095.json
cve.org/CVERecord?id=CVE-2009-1392