Every CVE Search/ Get API key

CVE-2009-5017

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes...

4.3 MediumFix available

CVE-2009-5017 is a medium vulnerability (CVSS 4.3) in Mozilla Firefox, published November 12, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 78th percentile. Fixed in firefox 0:3.6.4-8.el4.

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.

Exploit likelihood

1.83%Up 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.

Record
CVE-2009-5017
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.

Record
CVE-2009-5017
Updated
2026-11-02
EUVDEUVD-2009-4975 No score

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.

Record
EUVD-2009-4975
Updated
2026-11-03
GitHub AdvisoriesGHSA-p83q-cg3p-77f9 No score

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes...

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.

Record
GHSA-p83q-cg3p-77f9
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Red Hat:enterprise_linux:4::as
 before 0:3.6.4-8.el4
0:3.6.4-8.el4
firefox-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:3.6.4-8.el4
0:3.6.4-8.el4
firefox
Red Hat:enterprise_linux:4::desktop
 before 0:3.6.4-8.el4
0:3.6.4-8.el4
firefox-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:3.6.4-8.el4
0:3.6.4-8.el4
firefox
Red Hat:enterprise_linux:4::es
 before 0:3.6.4-8.el4
0:3.6.4-8.el4
firefox-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:3.6.4-8.el4
0:3.6.4-8.el4
firefox
Red Hat:enterprise_linux:4::ws
 before 0:3.6.4-8.el4
0:3.6.4-8.el4
firefox-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:3.6.4-8.el4
0:3.6.4-8.el4
devhelp
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.12-21.el5
0:0.12-21.el5
devhelp-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.12-21.el5
0:0.12-21.el5
Show 49 moreShow less
Affected packages
PackageAffectedFixed
devhelp-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:0.12-21.el5
0:0.12-21.el5
totem
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
totem-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
totem-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
xulrunner
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
xulrunner-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
xulrunner-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
devhelp
Red Hat:enterprise_linux:5::client
 before 0:0.12-21.el5
0:0.12-21.el5
devhelp-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:0.12-21.el5
0:0.12-21.el5
esc
Red Hat:enterprise_linux:5::client
 before 0:1.1.0-12.el5
0:1.1.0-12.el5
esc-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:1.1.0-12.el5
0:1.1.0-12.el5
firefox
Red Hat:enterprise_linux:5::client
 before 0:3.6.4-8.el5
0:3.6.4-8.el5
firefox-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:3.6.4-8.el5
0:3.6.4-8.el5
gnome-python2-extras
Red Hat:enterprise_linux:5::client
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-extras-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-gtkhtml2
Red Hat:enterprise_linux:5::client
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-gtkmozembed
Red Hat:enterprise_linux:5::client
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-gtkspell
Red Hat:enterprise_linux:5::client
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-libegg
Red Hat:enterprise_linux:5::client
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
totem
Red Hat:enterprise_linux:5::client
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
totem-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
totem-mozplugin
Red Hat:enterprise_linux:5::client
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
xulrunner
Red Hat:enterprise_linux:5::client
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
xulrunner-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
xulrunner-devel
Red Hat:enterprise_linux:5::client
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
yelp
Red Hat:enterprise_linux:5::client
 before 0:2.16.0-26.el5
0:2.16.0-26.el5
yelp-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:2.16.0-26.el5
0:2.16.0-26.el5
devhelp
Red Hat:enterprise_linux:5::server
 before 0:0.12-21.el5
0:0.12-21.el5
devhelp-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:0.12-21.el5
0:0.12-21.el5
devhelp-devel
Red Hat:enterprise_linux:5::server
 before 0:0.12-21.el5
0:0.12-21.el5
esc
Red Hat:enterprise_linux:5::server
 before 0:1.1.0-12.el5
0:1.1.0-12.el5
esc-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.1.0-12.el5
0:1.1.0-12.el5
firefox
Red Hat:enterprise_linux:5::server
 before 0:3.6.4-8.el5
0:3.6.4-8.el5
firefox-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:3.6.4-8.el5
0:3.6.4-8.el5
gnome-python2-extras
Red Hat:enterprise_linux:5::server
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-extras-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-gtkhtml2
Red Hat:enterprise_linux:5::server
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-gtkmozembed
Red Hat:enterprise_linux:5::server
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-gtkspell
Red Hat:enterprise_linux:5::server
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
gnome-python2-libegg
Red Hat:enterprise_linux:5::server
 before 0:2.14.2-7.el5
0:2.14.2-7.el5
totem
Red Hat:enterprise_linux:5::server
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
totem-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
totem-devel
Red Hat:enterprise_linux:5::server
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
totem-mozplugin
Red Hat:enterprise_linux:5::server
 before 0:2.16.7-7.el5
0:2.16.7-7.el5
xulrunner
Red Hat:enterprise_linux:5::server
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
xulrunner-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
xulrunner-devel
Red Hat:enterprise_linux:5::server
 before 0:1.9.2.4-10.el5
0:1.9.2.4-10.el5
yelp
Red Hat:enterprise_linux:5::server
 before 0:2.16.0-26.el5
0:2.16.0-26.el5
yelp-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:2.16.0-26.el5
0:2.16.0-26.el5

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 56 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open