CVE-2009-2061
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL...
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
Exploit likelihood
What each source reports
NVD Score used
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
- Record
CVE-2009-2061- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
- Record
CVE-2009-2061- Updated
- 2026-11-02
EUVDEUVD-2009-2057 No score
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
- Record
EUVD-2009-2057- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9v88-wfr2-2gxh No score
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL...
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
- Record
GHSA-9v88-wfr2-2gxh- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xulrunnerDebian:5.0 From an advisory covering 12 CVEs |
before 1.9.0.11-0lenny1, plus listed versions 1.9.0.10-11.9.0.5-11.9.0.6-11.9.0.7-0lenny11.9.0.7-0lenny2 Show 4 moreShow less1.9.0.7-11.9.0.8-11.9.0.9-0lenny21.9.0.9-1 |
1.9.0.11-0lenny1 |
icedoveDebian:5.0 From an advisory covering 19 CVEs |
before 2.0.0.22-0lenny1, plus listed versions 2.0.0.19-12.0.0.19-1+kbsd |
2.0.0.22-0lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2061 is a high vulnerability (CVSS 9.3) in Mozilla Firefox, published June 15, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. No source names a fixed version.