Vulnerability-Lookup

CVE-2009-3376 (GCVE-0-2009-3376)

Vulnerability from cvelistv5 – Published: 2009-10-29 14:00 – Updated: 2024-08-07 06:22

Summary

Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 29/100 over 2324 records in the last 180 days details

References

14 references

URL	Tags
http://www.redhat.com/support/errata/RHSA-2010-01…	vendor-advisoryx_refsource_REDHAT
http://www.vupen.com/english/advisories/2010/0648	vdb-entryx_refsource_VUPEN
http://www.vupen.com/english/advisories/2010/0650	vdb-entryx_refsource_VUPEN
http://sunsolve.sun.com/search/document.do?assetk…	vendor-advisoryx_refsource_SUNALERT
https://bugzilla.mozilla.org/show_bug.cgi?id=511521	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/38977	third-party-advisoryx_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2010-01…	vendor-advisoryx_refsource_REDHAT
http://www.mozilla.org/security/announce/2009/mfs…	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.ubuntu.com/usn/USN-915-1	vendor-advisoryx_refsource_UBUNTU
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.vupen.com/english/advisories/2009/3334	vdb-entryx_refsource_VUPEN
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA

Date Public

2009-10-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T06:22:24.510Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2010:0153",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
          },
          {
            "name": "ADV-2010-0648",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0648"
          },
          {
            "name": "ADV-2010-0650",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0650"
          },
          {
            "name": "272909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
          },
          {
            "name": "SUSE-SR:2010:013",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
          },
          {
            "name": "38977",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38977"
          },
          {
            "name": "RHSA-2010:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
          },
          {
            "name": "oval:org.mitre.oval:def:11218",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
          },
          {
            "name": "USN-915-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-915-1"
          },
          {
            "name": "oval:org.mitre.oval:def:6541",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
          },
          {
            "name": "ADV-2009-3334",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3334"
          },
          {
            "name": "MDVSA-2009:294",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-10-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2010:0153",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
        },
        {
          "name": "ADV-2010-0648",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0648"
        },
        {
          "name": "ADV-2010-0650",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0650"
        },
        {
          "name": "272909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
        },
        {
          "name": "SUSE-SR:2010:013",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
        },
        {
          "name": "38977",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38977"
        },
        {
          "name": "RHSA-2010:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
        },
        {
          "name": "oval:org.mitre.oval:def:11218",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
        },
        {
          "name": "USN-915-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-915-1"
        },
        {
          "name": "oval:org.mitre.oval:def:6541",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
        },
        {
          "name": "ADV-2009-3334",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3334"
        },
        {
          "name": "MDVSA-2009:294",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-3376",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2010:0153",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
            },
            {
              "name": "ADV-2010-0648",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0648"
            },
            {
              "name": "ADV-2010-0650",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0650"
            },
            {
              "name": "272909",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
            },
            {
              "name": "SUSE-SR:2010:013",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
            },
            {
              "name": "38977",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38977"
            },
            {
              "name": "RHSA-2010:0154",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
            },
            {
              "name": "oval:org.mitre.oval:def:11218",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
            },
            {
              "name": "USN-915-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-915-1"
            },
            {
              "name": "oval:org.mitre.oval:def:6541",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
            },
            {
              "name": "ADV-2009-3334",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3334"
            },
            {
              "name": "MDVSA-2009:294",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-3376",
    "datePublished": "2009-10-29T14:00:00.000Z",
    "dateReserved": "2009-09-24T00:00:00.000Z",
    "dateUpdated": "2024-08-07T06:22:24.510Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2009-3376",
      "date": "2026-10-25",
      "epss": "0.03183",
      "percentile": "0.87984"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
                  "matchCriteriaId": "20139741-10B1-4E4B-8D5F-A715042049C4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "63DF3D65-C992-44CF-89B4-893526C6242E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A9024117-2E8B-4240-9E21-CC501F3879B5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "52624B41-AB34-40AD-8709-D9646B618AB0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*",
                  "matchCriteriaId": "917E9856-9556-4FD6-A834-858F8837A6B4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*",
                  "matchCriteriaId": "98BBD74D-930C-4D80-A91B-0D61347BAA63",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FAF2E696-883D-4DE5-8B79-D8E5D9470253",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*",
                  "matchCriteriaId": "94E04FD9-38E8-462D-82C2-729F7F7F0465",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5888517E-3C57-4A0A-9895-EA4BCB0A0ED5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0BB21291-B9F3-445E-A9E9-EA1822083DD3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D595F649-ECBE-45E0-8AAD-BCBC65A654B9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "031E8624-5161-43AF-AF19-6BAB5A94FDD8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "54186D4A-C6F0-44AD-94FB-73B4346ABB6B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "47E50AD9-BA35-4817-BD4D-5D678FC5A3C5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "78D4B6BB-B349-47FC-A13E-8C4C95D9959B",
                  "versionEndIncluding": "1.5.0.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "09E18FC0-0C8C-4FA1-85B9-B868D00F002F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*",
                  "matchCriteriaId": "4A97B6E1-EABA-4977-A3FC-64DF0392AA95",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*",
                  "matchCriteriaId": "CB01A97F-ACE1-4A99-8939-6DF8FE5B5E8E",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6521C877-63C9-4B6E-9FC9-1263FFBB7950",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D949DF0A-CBC2-40E1-AE6C-60E6F58D2481",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3C5CDA57-1A50-4EDB-80E2-D3EBB44EA653",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "22D33486-4956-4E2C-BA16-FA269A9D02BD",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3104343E-93B6-4D4A-BC95-ED9F7E91FB6A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "381313EF-DF84-4F66-9962-DE8F45029D79",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A0228476-14E4-443C-BBAE-2C9CD8594DC0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A803A500-DCE2-44FC-ABEB-A90A1D39D85C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*",
                  "matchCriteriaId": "022274DE-5251-49C9-B6E5-1D8CEDC34E7D",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "B9F84CB7-93F7-4912-BC87-497867B96491",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*",
                  "matchCriteriaId": "8992E9C6-09B3-492E-B7DA-899D5238EC18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*",
                  "matchCriteriaId": "D58B704B-F06E-44C1-BBD1-A090D1E6583A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "40270FBD-744A-49D9-9FFA-1DCD897210D7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*",
                  "matchCriteriaId": "20E01097-F60A-4FB2-BA47-84A267EE87D6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7F65732F-317B-49A2-B9B0-FA1102B8B45C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DB430F19-069A-43FD-9097-586D4449D327",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "76AD0439-3BFB-4AD1-8E2C-99D0B099FA8C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*",
                  "matchCriteriaId": "1E6D7528-E591-48A6-8165-BE42F8EBF6B6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BA710423-0075-44B8-9DCB-6380FA974486",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C5521DA3-E6AF-4350-B971-10B4A1C9B1D1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*",
                  "matchCriteriaId": "DDD15752-A253-47B1-BCE0-B55B84B47C9F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*",
                  "matchCriteriaId": "60B39A9D-44A4-4D7F-9004-C44066BBE277",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F203EC52-2126-4227-AF3B-23857E5BB222",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E951567B-8402-42EA-AE33-EBA9235A868F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*",
                  "matchCriteriaId": "82A94198-7EBF-4D8A-A99A-A32A8561FF2F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*",
                  "matchCriteriaId": "1BFFBC58-ACD2-449D-B010-5026D6022F86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*",
                  "matchCriteriaId": "83EED5D2-EC40-4253-991B-0C746FBEF6A5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0F73092C-1458-4278-A30D-C0F89B1F82F6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*",
                  "matchCriteriaId": "AAB559BD-4BF7-417F-962F-B8971FF1614B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*",
                  "matchCriteriaId": "69DD17EC-99EB-46C1-98E9-16A2EDB8E224",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F35F7EA1-8C98-4A3E-8767-89DBC26A32B9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file."
        },
        {
          "lang": "es",
          "value": "Mozilla Firefox anteriores a v3.0.15 y v3.5.x anteriores a v3.5.4, y SeaMonkey anteriores a v2.0, no maneja adecuadamente una anulaci\u00f3n de car\u00e1cter Unicode \"right-to-left\" (tambi\u00e9n conocido como RLO o U+202E) en un nombre de fichero de descarga, lo que permite a atacantes remotos falsificar las extensiones de fichero a trav\u00e9s de un nombre de fichero manipulado como se demuestra en una extensi\u00f3n no ejecutable de un fichero ejecutable."
        }
      ],
      "id": "CVE-2009-3376",
      "lastModified": "2024-11-21T01:07:12.953",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "HIGH",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "COMPLETE",
              "baseScore": 9.3,
              "confidentialityImpact": "COMPLETE",
              "integrityImpact": "COMPLETE",
              "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
              "version": "2.0"
            },
            "exploitabilityScore": 8.6,
            "impactScore": 10.0,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ]
      },
      "published": "2009-10-29T14:30:00.983",
      "references": [
        {
          "source": "cve@mitre.org",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://secunia.com/advisories/38977"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.ubuntu.com/usn/USN-915-1"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.vupen.com/english/advisories/2009/3334"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.vupen.com/english/advisories/2010/0648"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.vupen.com/english/advisories/2010/0650"
        },
        {
          "source": "cve@mitre.org",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
        },
        {
          "source": "cve@mitre.org",
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
        },
        {
          "source": "cve@mitre.org",
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://secunia.com/advisories/38977"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.ubuntu.com/usn/USN-915-1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.vupen.com/english/advisories/2009/3334"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.vupen.com/english/advisories/2010/0648"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.vupen.com/english/advisories/2010/0650"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-16"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
                    "matchCriteriaId": "20139741-10B1-4E4B-8D5F-A715042049C4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "63DF3D65-C992-44CF-89B4-893526C6242E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A9024117-2E8B-4240-9E21-CC501F3879B5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "52624B41-AB34-40AD-8709-D9646B618AB0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "917E9856-9556-4FD6-A834-858F8837A6B4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "98BBD74D-930C-4D80-A91B-0D61347BAA63",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FAF2E696-883D-4DE5-8B79-D8E5D9470253",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "94E04FD9-38E8-462D-82C2-729F7F7F0465",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5888517E-3C57-4A0A-9895-EA4BCB0A0ED5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0BB21291-B9F3-445E-A9E9-EA1822083DD3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D595F649-ECBE-45E0-8AAD-BCBC65A654B9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "031E8624-5161-43AF-AF19-6BAB5A94FDD8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "54186D4A-C6F0-44AD-94FB-73B4346ABB6B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "47E50AD9-BA35-4817-BD4D-5D678FC5A3C5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "78D4B6BB-B349-47FC-A13E-8C4C95D9959B",
                    "versionEndIncluding": "1.5.0.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "09E18FC0-0C8C-4FA1-85B9-B868D00F002F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*",
                    "matchCriteriaId": "4A97B6E1-EABA-4977-A3FC-64DF0392AA95",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*",
                    "matchCriteriaId": "CB01A97F-ACE1-4A99-8939-6DF8FE5B5E8E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6521C877-63C9-4B6E-9FC9-1263FFBB7950",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D949DF0A-CBC2-40E1-AE6C-60E6F58D2481",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3C5CDA57-1A50-4EDB-80E2-D3EBB44EA653",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "22D33486-4956-4E2C-BA16-FA269A9D02BD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3104343E-93B6-4D4A-BC95-ED9F7E91FB6A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "381313EF-DF84-4F66-9962-DE8F45029D79",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A0228476-14E4-443C-BBAE-2C9CD8594DC0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A803A500-DCE2-44FC-ABEB-A90A1D39D85C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "022274DE-5251-49C9-B6E5-1D8CEDC34E7D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B9F84CB7-93F7-4912-BC87-497867B96491",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*",
                    "matchCriteriaId": "8992E9C6-09B3-492E-B7DA-899D5238EC18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*",
                    "matchCriteriaId": "D58B704B-F06E-44C1-BBD1-A090D1E6583A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "40270FBD-744A-49D9-9FFA-1DCD897210D7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20E01097-F60A-4FB2-BA47-84A267EE87D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F65732F-317B-49A2-B9B0-FA1102B8B45C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DB430F19-069A-43FD-9097-586D4449D327",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "76AD0439-3BFB-4AD1-8E2C-99D0B099FA8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1E6D7528-E591-48A6-8165-BE42F8EBF6B6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BA710423-0075-44B8-9DCB-6380FA974486",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C5521DA3-E6AF-4350-B971-10B4A1C9B1D1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DDD15752-A253-47B1-BCE0-B55B84B47C9F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "60B39A9D-44A4-4D7F-9004-C44066BBE277",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F203EC52-2126-4227-AF3B-23857E5BB222",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E951567B-8402-42EA-AE33-EBA9235A868F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*",
                    "matchCriteriaId": "82A94198-7EBF-4D8A-A99A-A32A8561FF2F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1BFFBC58-ACD2-449D-B010-5026D6022F86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*",
                    "matchCriteriaId": "83EED5D2-EC40-4253-991B-0C746FBEF6A5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0F73092C-1458-4278-A30D-C0F89B1F82F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AAB559BD-4BF7-417F-962F-B8971FF1614B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*",
                    "matchCriteriaId": "69DD17EC-99EB-46C1-98E9-16A2EDB8E224",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F35F7EA1-8C98-4A3E-8767-89DBC26A32B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file."
          },
          {
            "lang": "es",
            "value": "Mozilla Firefox anteriores a v3.0.15 y v3.5.x anteriores a v3.5.4, y SeaMonkey anteriores a v2.0, no maneja adecuadamente una anulaci\u00f3n de car\u00e1cter Unicode \"right-to-left\" (tambi\u00e9n conocido como RLO o U+202E) en un nombre de fichero de descarga, lo que permite a atacantes remotos falsificar las extensiones de fichero a trav\u00e9s de un nombre de fichero manipulado como se demuestra en una extensi\u00f3n no ejecutable de un fichero ejecutable."
          }
        ],
        "id": "CVE-2009-3376",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 9.3,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ]
        },
        "published": "2009-10-29T14:30:00.983",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/38977"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.ubuntu.com/usn/USN-915-1"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2009/3334"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2010/0648"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2010/0650"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/38977"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/USN-915-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2009/3334"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2010/0648"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2010/0650"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-16"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T13:10:09+00:00",
      "cve": "CVE-2009-3376",
      "id": "CVE-2009-3376",
      "initial_release_date": "2009-10-27T00:00:00+00:00",
      "product_status:fixed": "811",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Firefox download filename spoofing with RTL override",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2009/cve-2009-3376.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-10-26T01:00:28Z",
      "cve": "CVE-2009-3376",
      "id": "CVE-2009-3376",
      "initial_release_date": "2023-02-15T06:02:28Z",
      "product_status:known_affected": "1",
      "product_status:recommended": "206",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2009-3376",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2023/cve-2009-3376.json",
      "version": "17"
    }
  }
}

CERTA-2009-AVI-459

Vulnerability from certfr_avis - Published: - Updated:

De nombreuses vulnérabilités de Mozilla Firefox ont été publiées. Certaines permettent à un utilisateur malveillant d'exécuter du code arbitraire à distance.

Description

De nombreuses vulnérabilités de Mozilla Firefox ont été publiées :

une erreur de traitement du formulaire d'historique permet de lire des informations sans en avoir le droit ;
la prévisibilité des noms des fichiers téléchargés est exploitable par un utilisateur malveillant ayant un accès au système vulnérable pour exécuter du code arbitraire ;
une mauvaise gestion de récursivité permet à un utilisateur malveillant de provoquer un déni de service, voire exécuter du code arbitraire ;
un traitement défectueux des fichers de configuration automatique (PAC) permet à un utilisateur malveillant de provoquer un déni de service à distance, voire exécuter du code arbitraire, quand le navigateur est configuré pour utiliser ces fichiers ;
une mauvaise analyse des images au format GIF permet à un utilisateur malveillant de provoquer un déni de service à distance, voire exécuter du code arbitraire ;
le module XPCOM comporte un défaut exploitable pour exécuter des JavaScripts avec des privilèges élevés ;
la conversion des chaînes de caractères en nombres en virgule flottante comporte un défaut exploitable pour exécuter du code arbitraire ;
la fonction JavaScript document.getSelection ne respecte pas la politique de séparation des domaines ;
le caractère unicode d'inversion du sens de lecture (Right to left override character) inclus dans un nom de fichier peut tromper l'utilisateur sur la nature de l'objet qu'il télécharge.

Solution

Les versions 3.0.15 et 3.5.4 remédient à ces problèmes.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Mozilla Firefox, versions 3.0.x et 3.5.x.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletins de sécurité de la fondation Mozilla du 27 octobre 2009	None	vendor-advisory
Bulletin de sécurité Debian DSA-1922 du 28 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletin de sécurité RedHat RHSA-2009:1530 du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletin de sécurité Ubuntu USN-853-1 du 31 octobre 2009 :	-	other
Bulletin de sécurité RedHat RHSA-2009:1531 du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cSPAN class=\"textit\"\u003eMozilla  Firefox\u003c/SPAN\u003e, versions 3.0.x et 3.5.x.",
  "content": "## Description\n\nDe nombreuses vuln\u00e9rabilit\u00e9s de Mozilla Firefox ont \u00e9t\u00e9 publi\u00e9es :\n\n-   une erreur de traitement du formulaire d\u0027historique permet de lire\n    des informations sans en avoir le droit\u00a0;\n-   la pr\u00e9visibilit\u00e9 des noms des fichiers t\u00e9l\u00e9charg\u00e9s est exploitable\n    par un utilisateur malveillant ayant un acc\u00e8s au syst\u00e8me vuln\u00e9rable\n    pour ex\u00e9cuter du code arbitraire\u00a0;\n-   une mauvaise gestion de r\u00e9cursivit\u00e9 permet \u00e0 un utilisateur\n    malveillant de provoquer un d\u00e9ni de service, voire ex\u00e9cuter du code\n    arbitraire\u00a0;\n-   un traitement d\u00e9fectueux des fichers de configuration automatique\n    (PAC) permet \u00e0 un utilisateur malveillant de provoquer un d\u00e9ni de\n    service \u00e0 distance, voire ex\u00e9cuter du code arbitraire, quand le\n    navigateur est configur\u00e9 pour utiliser ces fichiers\u00a0;\n-   une mauvaise analyse des images au format GIF permet \u00e0 un\n    utilisateur malveillant de provoquer un d\u00e9ni de service \u00e0 distance,\n    voire ex\u00e9cuter du code arbitraire\u00a0;\n-   le module XPCOM comporte un d\u00e9faut exploitable pour ex\u00e9cuter des\n    JavaScripts avec des privil\u00e8ges \u00e9lev\u00e9s\u00a0;\n-   la conversion des cha\u00eenes de caract\u00e8res en nombres en virgule\n    flottante comporte un d\u00e9faut exploitable pour ex\u00e9cuter du code\n    arbitraire\u00a0;\n-   la fonction JavaScript document.getSelection ne respecte pas la\n    politique de s\u00e9paration des domaines\u00a0;\n-   le caract\u00e8re unicode d\u0027inversion du sens de lecture (Right to left\n    override character) inclus dans un nom de fichier peut tromper\n    l\u0027utilisateur sur la nature de l\u0027objet qu\u0027il t\u00e9l\u00e9charge.\n\n## Solution\n\nLes versions 3.0.15 et 3.5.4 rem\u00e9dient \u00e0 ces probl\u00e8mes.\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-3381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3381"
    },
    {
      "name": "CVE-2009-3375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3375"
    },
    {
      "name": "CVE-2009-3378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3378"
    },
    {
      "name": "CVE-2009-3380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3380"
    },
    {
      "name": "CVE-2009-3382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3382"
    },
    {
      "name": "CVE-2009-3383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3383"
    },
    {
      "name": "CVE-2009-3377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3377"
    },
    {
      "name": "CVE-2009-3372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3372"
    },
    {
      "name": "CVE-2009-3376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3376"
    },
    {
      "name": "CVE-2009-3371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3371"
    },
    {
      "name": "CVE-2009-1563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1563"
    },
    {
      "name": "CVE-2009-3379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3379"
    },
    {
      "name": "CVE-2009-3373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3373"
    },
    {
      "name": "CVE-2009-3374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3374"
    },
    {
      "name": "CVE-2009-3370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3370"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1922 du 28 octobre 2009 :",
      "url": "http://www.debian.org/security/2009/dsa-1922"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-63.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-56.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-54.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-55.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-52.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-61.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2009:1530 du 27 octobre    2009 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2009-1530.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-64.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-57.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-53.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-59.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-853-1 du 31 octobre 2009 :",
      "url": "http://www.ubuntu.com/usn/USN-853-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2009:1531 du 27 octobre    2009 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2009-1531.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
    }
  ],
  "reference": "CERTA-2009-AVI-459",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-10-28T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Debian, RedHat et Ubuntu.",
      "revision_date": "2009-11-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De nombreuses vuln\u00e9rabilit\u00e9s de \u003cspan class=\"textit\"\u003eMozilla\nFirefox\u003c/span\u003e ont \u00e9t\u00e9 publi\u00e9es. Certaines permettent \u00e0 un utilisateur\nmalveillant d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Mozilla Firefox",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla du 27 octobre 2009",
      "url": null
    }
  ]
}

CERTA-2010-AVI-008

Vulnerability from certfr_avis - Published: - Updated:

Plusieurs vulnérabilités dans VMware ESX permettent, entre autre, à une personne malintentionnée d'exécuter du code arbitraire à distance

Description

De multiples vulnérabilités, non documentées, dans VMware ESX permettent, entre autre, à une personne distante malintentionnée d'exécuter du code arbitraire.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

VMware ESX 4.0 sans le correctif ESX400-200912403-SG.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2010-0001 du 06 janvier 2010	None	vendor-advisory
Bulletin de sécurité VMware VMSA-2010-0001 du 06 janvier 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eVMware ESX 4.0 sans le correctif ESX400-200912403-SG.\u003c/P\u003e",
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s, non document\u00e9es, dans VMware ESX\npermettent, entre autre, \u00e0 une personne distante malintentionn\u00e9e\nd\u0027ex\u00e9cuter du code arbitraire.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-3375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3375"
    },
    {
      "name": "CVE-2009-2408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2408"
    },
    {
      "name": "CVE-2009-3380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3380"
    },
    {
      "name": "CVE-2009-3382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3382"
    },
    {
      "name": "CVE-2009-3274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3274"
    },
    {
      "name": "CVE-2009-2404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2404"
    },
    {
      "name": "CVE-2009-3372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3372"
    },
    {
      "name": "CVE-2009-3376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3376"
    },
    {
      "name": "CVE-2009-1563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1563"
    },
    {
      "name": "CVE-2009-3373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3373"
    },
    {
      "name": "CVE-2009-2409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2409"
    },
    {
      "name": "CVE-2009-3374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3374"
    },
    {
      "name": "CVE-2009-3370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3370"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2010-0001 du 06 janvier    2010 :",
      "url": "http://lists.vmware.com/pipermail/security-announce/2010/000075.html"
    }
  ],
  "reference": "CERTA-2010-AVI-008",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-01-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans VMware ESX permettent, entre autre, \u00e0 une\npersonne malintentionn\u00e9e d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance\n",
  "title": "Mulitples vuln\u00e9rabilit\u00e9s dans VMware ESX",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2010-0001 du 06 janvier 2010",
      "url": null
    }
  ]
}

CERTA-2009-AVI-459

Vulnerability from certfr_avis - Published: - Updated:

De nombreuses vulnérabilités de Mozilla Firefox ont été publiées. Certaines permettent à un utilisateur malveillant d'exécuter du code arbitraire à distance.

Description

De nombreuses vulnérabilités de Mozilla Firefox ont été publiées :

une erreur de traitement du formulaire d'historique permet de lire des informations sans en avoir le droit ;
la prévisibilité des noms des fichiers téléchargés est exploitable par un utilisateur malveillant ayant un accès au système vulnérable pour exécuter du code arbitraire ;
une mauvaise gestion de récursivité permet à un utilisateur malveillant de provoquer un déni de service, voire exécuter du code arbitraire ;
un traitement défectueux des fichers de configuration automatique (PAC) permet à un utilisateur malveillant de provoquer un déni de service à distance, voire exécuter du code arbitraire, quand le navigateur est configuré pour utiliser ces fichiers ;
une mauvaise analyse des images au format GIF permet à un utilisateur malveillant de provoquer un déni de service à distance, voire exécuter du code arbitraire ;
le module XPCOM comporte un défaut exploitable pour exécuter des JavaScripts avec des privilèges élevés ;
la conversion des chaînes de caractères en nombres en virgule flottante comporte un défaut exploitable pour exécuter du code arbitraire ;
la fonction JavaScript document.getSelection ne respecte pas la politique de séparation des domaines ;
le caractère unicode d'inversion du sens de lecture (Right to left override character) inclus dans un nom de fichier peut tromper l'utilisateur sur la nature de l'objet qu'il télécharge.

Solution

Les versions 3.0.15 et 3.5.4 remédient à ces problèmes.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Mozilla Firefox, versions 3.0.x et 3.5.x.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletins de sécurité de la fondation Mozilla du 27 octobre 2009	None	vendor-advisory
Bulletin de sécurité Debian DSA-1922 du 28 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletin de sécurité RedHat RHSA-2009:1530 du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other
Bulletin de sécurité Ubuntu USN-853-1 du 31 octobre 2009 :	-	other
Bulletin de sécurité RedHat RHSA-2009:1531 du 27 octobre 2009 :	-	other
Bulletins de sécurité de la fondation Mozilla 2009/mfsa2009-52 et suivants du 27 octobre 2009 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cSPAN class=\"textit\"\u003eMozilla  Firefox\u003c/SPAN\u003e, versions 3.0.x et 3.5.x.",
  "content": "## Description\n\nDe nombreuses vuln\u00e9rabilit\u00e9s de Mozilla Firefox ont \u00e9t\u00e9 publi\u00e9es :\n\n-   une erreur de traitement du formulaire d\u0027historique permet de lire\n    des informations sans en avoir le droit\u00a0;\n-   la pr\u00e9visibilit\u00e9 des noms des fichiers t\u00e9l\u00e9charg\u00e9s est exploitable\n    par un utilisateur malveillant ayant un acc\u00e8s au syst\u00e8me vuln\u00e9rable\n    pour ex\u00e9cuter du code arbitraire\u00a0;\n-   une mauvaise gestion de r\u00e9cursivit\u00e9 permet \u00e0 un utilisateur\n    malveillant de provoquer un d\u00e9ni de service, voire ex\u00e9cuter du code\n    arbitraire\u00a0;\n-   un traitement d\u00e9fectueux des fichers de configuration automatique\n    (PAC) permet \u00e0 un utilisateur malveillant de provoquer un d\u00e9ni de\n    service \u00e0 distance, voire ex\u00e9cuter du code arbitraire, quand le\n    navigateur est configur\u00e9 pour utiliser ces fichiers\u00a0;\n-   une mauvaise analyse des images au format GIF permet \u00e0 un\n    utilisateur malveillant de provoquer un d\u00e9ni de service \u00e0 distance,\n    voire ex\u00e9cuter du code arbitraire\u00a0;\n-   le module XPCOM comporte un d\u00e9faut exploitable pour ex\u00e9cuter des\n    JavaScripts avec des privil\u00e8ges \u00e9lev\u00e9s\u00a0;\n-   la conversion des cha\u00eenes de caract\u00e8res en nombres en virgule\n    flottante comporte un d\u00e9faut exploitable pour ex\u00e9cuter du code\n    arbitraire\u00a0;\n-   la fonction JavaScript document.getSelection ne respecte pas la\n    politique de s\u00e9paration des domaines\u00a0;\n-   le caract\u00e8re unicode d\u0027inversion du sens de lecture (Right to left\n    override character) inclus dans un nom de fichier peut tromper\n    l\u0027utilisateur sur la nature de l\u0027objet qu\u0027il t\u00e9l\u00e9charge.\n\n## Solution\n\nLes versions 3.0.15 et 3.5.4 rem\u00e9dient \u00e0 ces probl\u00e8mes.\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-3381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3381"
    },
    {
      "name": "CVE-2009-3375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3375"
    },
    {
      "name": "CVE-2009-3378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3378"
    },
    {
      "name": "CVE-2009-3380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3380"
    },
    {
      "name": "CVE-2009-3382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3382"
    },
    {
      "name": "CVE-2009-3383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3383"
    },
    {
      "name": "CVE-2009-3377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3377"
    },
    {
      "name": "CVE-2009-3372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3372"
    },
    {
      "name": "CVE-2009-3376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3376"
    },
    {
      "name": "CVE-2009-3371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3371"
    },
    {
      "name": "CVE-2009-1563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1563"
    },
    {
      "name": "CVE-2009-3379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3379"
    },
    {
      "name": "CVE-2009-3373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3373"
    },
    {
      "name": "CVE-2009-3374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3374"
    },
    {
      "name": "CVE-2009-3370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3370"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1922 du 28 octobre 2009 :",
      "url": "http://www.debian.org/security/2009/dsa-1922"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-63.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-56.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-54.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-55.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-52.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-61.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2009:1530 du 27 octobre    2009 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2009-1530.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-64.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-57.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-53.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-59.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-853-1 du 31 octobre 2009 :",
      "url": "http://www.ubuntu.com/usn/USN-853-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2009:1531 du 27 octobre    2009 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2009-1531.html"
    },
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla    2009/mfsa2009-52 et suivants du 27 octobre 2009 :",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
    }
  ],
  "reference": "CERTA-2009-AVI-459",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-10-28T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Debian, RedHat et Ubuntu.",
      "revision_date": "2009-11-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De nombreuses vuln\u00e9rabilit\u00e9s de \u003cspan class=\"textit\"\u003eMozilla\nFirefox\u003c/span\u003e ont \u00e9t\u00e9 publi\u00e9es. Certaines permettent \u00e0 un utilisateur\nmalveillant d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Mozilla Firefox",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 de la fondation Mozilla du 27 octobre 2009",
      "url": null
    }
  ]
}

CERTA-2010-AVI-008

Vulnerability from certfr_avis - Published: - Updated:

Plusieurs vulnérabilités dans VMware ESX permettent, entre autre, à une personne malintentionnée d'exécuter du code arbitraire à distance

Description

De multiples vulnérabilités, non documentées, dans VMware ESX permettent, entre autre, à une personne distante malintentionnée d'exécuter du code arbitraire.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

VMware ESX 4.0 sans le correctif ESX400-200912403-SG.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2010-0001 du 06 janvier 2010	None	vendor-advisory
Bulletin de sécurité VMware VMSA-2010-0001 du 06 janvier 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003eVMware ESX 4.0 sans le correctif ESX400-200912403-SG.\u003c/P\u003e",
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s, non document\u00e9es, dans VMware ESX\npermettent, entre autre, \u00e0 une personne distante malintentionn\u00e9e\nd\u0027ex\u00e9cuter du code arbitraire.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-3375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3375"
    },
    {
      "name": "CVE-2009-2408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2408"
    },
    {
      "name": "CVE-2009-3380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3380"
    },
    {
      "name": "CVE-2009-3382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3382"
    },
    {
      "name": "CVE-2009-3274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3274"
    },
    {
      "name": "CVE-2009-2404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2404"
    },
    {
      "name": "CVE-2009-3372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3372"
    },
    {
      "name": "CVE-2009-3376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3376"
    },
    {
      "name": "CVE-2009-1563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-1563"
    },
    {
      "name": "CVE-2009-3373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3373"
    },
    {
      "name": "CVE-2009-2409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-2409"
    },
    {
      "name": "CVE-2009-3374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3374"
    },
    {
      "name": "CVE-2009-3370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3370"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2010-0001 du 06 janvier    2010 :",
      "url": "http://lists.vmware.com/pipermail/security-announce/2010/000075.html"
    }
  ],
  "reference": "CERTA-2010-AVI-008",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-01-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans VMware ESX permettent, entre autre, \u00e0 une\npersonne malintentionn\u00e9e d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance\n",
  "title": "Mulitples vuln\u00e9rabilit\u00e9s dans VMware ESX",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2010-0001 du 06 janvier 2010",
      "url": null
    }
  ]
}

FKIE_CVE-2009-3376

Vulnerability from fkie_nvd - Published: 2009-10-29 14:30 - Updated: 2026-06-16 23:11

Severity

Summary

References

URL	Tags
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
cve@mitre.org	http://secunia.com/advisories/38977
cve@mitre.org	http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1
cve@mitre.org	http://www.mandriva.com/security/advisories?name=MDVSA-2009:294
cve@mitre.org	http://www.mozilla.org/security/announce/2009/mfsa2009-62.html	Patch, Vendor Advisory
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2010-0153.html
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2010-0154.html
cve@mitre.org	http://www.ubuntu.com/usn/USN-915-1
cve@mitre.org	http://www.vupen.com/english/advisories/2009/3334
cve@mitre.org	http://www.vupen.com/english/advisories/2010/0648
cve@mitre.org	http://www.vupen.com/english/advisories/2010/0650
cve@mitre.org	https://bugzilla.mozilla.org/show_bug.cgi?id=511521
cve@mitre.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218
cve@mitre.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/38977
af854a3a-2127-422b-91ae-364da2661108	http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1
af854a3a-2127-422b-91ae-364da2661108	http://www.mandriva.com/security/advisories?name=MDVSA-2009:294
af854a3a-2127-422b-91ae-364da2661108	http://www.mozilla.org/security/announce/2009/mfsa2009-62.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2010-0153.html
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2010-0154.html
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/USN-915-1
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2009/3334
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2010/0648
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2010/0650
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.mozilla.org/show_bug.cgi?id=511521
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541

Impacted products

Vendor	Product	Version
mozilla	firefox	3.0
mozilla	firefox	3.0.1
mozilla	firefox	3.0.2
mozilla	firefox	3.0.3
mozilla	firefox	3.0.4
mozilla	firefox	3.0.5
mozilla	firefox	3.0.6
mozilla	firefox	3.0.7
mozilla	firefox	3.0.8
mozilla	firefox	3.0.9
mozilla	firefox	3.0.10
mozilla	firefox	3.0.11
mozilla	firefox	3.0.12
mozilla	firefox	3.0.13
mozilla	firefox	3.5.1
mozilla	firefox	3.5.2
mozilla	firefox	3.5.3
mozilla	seamonkey	*
mozilla	seamonkey	1.0
mozilla	seamonkey	1.0
mozilla	seamonkey	1.0
mozilla	seamonkey	1.0.1
mozilla	seamonkey	1.0.2
mozilla	seamonkey	1.0.3
mozilla	seamonkey	1.0.4
mozilla	seamonkey	1.0.5
mozilla	seamonkey	1.0.6
mozilla	seamonkey	1.0.7
mozilla	seamonkey	1.0.8
mozilla	seamonkey	1.0.9
mozilla	seamonkey	1.1
mozilla	seamonkey	1.1
mozilla	seamonkey	1.1
mozilla	seamonkey	1.1.1
mozilla	seamonkey	1.1.2
mozilla	seamonkey	1.1.3
mozilla	seamonkey	1.1.4
mozilla	seamonkey	1.1.5
mozilla	seamonkey	1.1.6
mozilla	seamonkey	1.1.7
mozilla	seamonkey	1.1.8
mozilla	seamonkey	1.1.9
mozilla	seamonkey	1.1.10
mozilla	seamonkey	1.1.11
mozilla	seamonkey	1.1.12
mozilla	seamonkey	1.1.13
mozilla	seamonkey	1.1.14
mozilla	seamonkey	1.1.15
mozilla	seamonkey	1.1.16
mozilla	seamonkey	1.1.17
mozilla	seamonkey	1.5.0.8
mozilla	seamonkey	1.5.0.9

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "20139741-10B1-4E4B-8D5F-A715042049C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "63DF3D65-C992-44CF-89B4-893526C6242E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9024117-2E8B-4240-9E21-CC501F3879B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "52624B41-AB34-40AD-8709-D9646B618AB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "917E9856-9556-4FD6-A834-858F8837A6B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "98BBD74D-930C-4D80-A91B-0D61347BAA63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "FAF2E696-883D-4DE5-8B79-D8E5D9470253",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "94E04FD9-38E8-462D-82C2-729F7F7F0465",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "5888517E-3C57-4A0A-9895-EA4BCB0A0ED5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BB21291-B9F3-445E-A9E9-EA1822083DD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "D595F649-ECBE-45E0-8AAD-BCBC65A654B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "031E8624-5161-43AF-AF19-6BAB5A94FDD8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "54186D4A-C6F0-44AD-94FB-73B4346ABB6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "47E50AD9-BA35-4817-BD4D-5D678FC5A3C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "78D4B6BB-B349-47FC-A13E-8C4C95D9959B",
              "versionEndIncluding": "1.5.0.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "09E18FC0-0C8C-4FA1-85B9-B868D00F002F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "4A97B6E1-EABA-4977-A3FC-64DF0392AA95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "CB01A97F-ACE1-4A99-8939-6DF8FE5B5E8E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6521C877-63C9-4B6E-9FC9-1263FFBB7950",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D949DF0A-CBC2-40E1-AE6C-60E6F58D2481",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C5CDA57-1A50-4EDB-80E2-D3EBB44EA653",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "22D33486-4956-4E2C-BA16-FA269A9D02BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "3104343E-93B6-4D4A-BC95-ED9F7E91FB6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "381313EF-DF84-4F66-9962-DE8F45029D79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0228476-14E4-443C-BBAE-2C9CD8594DC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "A803A500-DCE2-44FC-ABEB-A90A1D39D85C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "022274DE-5251-49C9-B6E5-1D8CEDC34E7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B9F84CB7-93F7-4912-BC87-497867B96491",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*",
              "matchCriteriaId": "8992E9C6-09B3-492E-B7DA-899D5238EC18",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*",
              "matchCriteriaId": "D58B704B-F06E-44C1-BBD1-A090D1E6583A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "40270FBD-744A-49D9-9FFA-1DCD897210D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "20E01097-F60A-4FB2-BA47-84A267EE87D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F65732F-317B-49A2-B9B0-FA1102B8B45C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB430F19-069A-43FD-9097-586D4449D327",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "76AD0439-3BFB-4AD1-8E2C-99D0B099FA8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E6D7528-E591-48A6-8165-BE42F8EBF6B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA710423-0075-44B8-9DCB-6380FA974486",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5521DA3-E6AF-4350-B971-10B4A1C9B1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "DDD15752-A253-47B1-BCE0-B55B84B47C9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "60B39A9D-44A4-4D7F-9004-C44066BBE277",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "F203EC52-2126-4227-AF3B-23857E5BB222",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "E951567B-8402-42EA-AE33-EBA9235A868F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "82A94198-7EBF-4D8A-A99A-A32A8561FF2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BFFBC58-ACD2-449D-B010-5026D6022F86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "83EED5D2-EC40-4253-991B-0C746FBEF6A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F73092C-1458-4278-A30D-C0F89B1F82F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAB559BD-4BF7-417F-962F-B8971FF1614B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "69DD17EC-99EB-46C1-98E9-16A2EDB8E224",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "F35F7EA1-8C98-4A3E-8767-89DBC26A32B9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox anteriores a v3.0.15 y v3.5.x anteriores a v3.5.4, y SeaMonkey anteriores a v2.0, no maneja adecuadamente una anulaci\u00f3n de car\u00e1cter Unicode \"right-to-left\" (tambi\u00e9n conocido como RLO o U+202E) en un nombre de fichero de descarga, lo que permite a atacantes remotos falsificar las extensiones de fichero a trav\u00e9s de un nombre de fichero manipulado como se demuestra en una extensi\u00f3n no ejecutable de un fichero ejecutable."
    }
  ],
  "id": "CVE-2009-3376",
  "lastModified": "2026-06-16T23:11:29.263",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-10-29T14:30:00.983",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/38977"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-915-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2009/3334"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2010/0648"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2010/0650"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/38977"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-915-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2009/3334"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/0648"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/0650"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-16"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-XGRC-85PP-86CG

Vulnerability from github – Published: 2022-05-02 03:44 – Updated: 2022-05-02 03:44

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2009-3376"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-10-29T14:30:00Z",
    "severity": "HIGH"
  },
  "details": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.",
  "id": "GHSA-xgrc-85pp-86cg",
  "modified": "2022-05-02T03:44:36Z",
  "published": "2022-05-02T03:44:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3376"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/38977"
    },
    {
      "type": "WEB",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
    },
    {
      "type": "WEB",
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-915-1"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/3334"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/0648"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/0650"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2009-3376

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2009-3376

Aliases

CVE-2009-3376

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2009-3376",
    "description": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.",
    "id": "GSD-2009-3376",
    "references": [
      "https://www.suse.com/security/cve/CVE-2009-3376.html",
      "https://www.debian.org/security/2009/dsa-1922",
      "https://access.redhat.com/errata/RHSA-2010:0154",
      "https://access.redhat.com/errata/RHSA-2010:0153",
      "https://access.redhat.com/errata/RHSA-2009:1531",
      "https://access.redhat.com/errata/RHSA-2009:1530",
      "https://linux.oracle.com/cve/CVE-2009-3376.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2009-3376"
      ],
      "details": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.",
      "id": "GSD-2009-3376",
      "modified": "2023-12-13T01:19:49.492400Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2009-3376",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "RHSA-2010:0153",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
          },
          {
            "name": "ADV-2010-0648",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2010/0648"
          },
          {
            "name": "ADV-2010-0650",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2010/0650"
          },
          {
            "name": "272909",
            "refsource": "SUNALERT",
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
          },
          {
            "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
          },
          {
            "name": "SUSE-SR:2010:013",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
          },
          {
            "name": "38977",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/38977"
          },
          {
            "name": "RHSA-2010:0154",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
          },
          {
            "name": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html",
            "refsource": "CONFIRM",
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
          },
          {
            "name": "oval:org.mitre.oval:def:11218",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
          },
          {
            "name": "USN-915-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-915-1"
          },
          {
            "name": "oval:org.mitre.oval:def:6541",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
          },
          {
            "name": "ADV-2009-3334",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/3334"
          },
          {
            "name": "MDVSA-2009:294",
            "refsource": "MANDRIVA",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.16:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.5.0.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.15:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.5.0.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0:beta5:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.5.0.10",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.14:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.12:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.13:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-3376"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-16"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-62.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=511521"
            },
            {
              "name": "MDVSA-2009:294",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:294"
            },
            {
              "name": "272909",
              "refsource": "SUNALERT",
              "tags": [],
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1"
            },
            {
              "name": "ADV-2009-3334",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2009/3334"
            },
            {
              "name": "ADV-2010-0650",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2010/0650"
            },
            {
              "name": "RHSA-2010:0153",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0153.html"
            },
            {
              "name": "ADV-2010-0648",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2010/0648"
            },
            {
              "name": "USN-915-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-915-1"
            },
            {
              "name": "RHSA-2010:0154",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0154.html"
            },
            {
              "name": "38977",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/38977"
            },
            {
              "name": "SUSE-SR:2010:013",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
            },
            {
              "name": "oval:org.mitre.oval:def:6541",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6541"
            },
            {
              "name": "oval:org.mitre.oval:def:11218",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11218"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2018-10-30T16:25Z",
      "publishedDate": "2009-10-29T14:30Z"
    }
  }
}

OPENSUSE-SU-2024:10071-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-10-11 11:53

Summary

MozillaFirefox-50.1.0-1.1 on GA media

Severity

Moderate

Scope

899 vulnerabilities in this advisory, including CVE-2009-3376.

CVE-2009-3376

Recommended: 24 products

Open the full advisory

OPENSUSE-SU-2024:14572-1

Vulnerability from csaf_opensuse - Published: 2024-12-12 00:00 - Updated: 2026-10-18 10:26

Summary

firefox-esr-128.5.1-1.1 on GA media

Severity

Moderate

Scope

1860 vulnerabilities in this advisory, including CVE-2009-3376.

CVE-2009-3376

Recommended: 16 products

Open the full advisory

RHSA-2009:1530

Vulnerability from csaf_redhat - Published: 2009-10-27 22:43 - Updated: 2026-06-25 10:36

Summary

Red Hat Security Advisory: firefox security update

Severity

Critical

Scope

12 vulnerabilities in this advisory, including CVE-2009-3376.

CVE-2009-3376

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:P/A:N

Fixed: 169 products

https://access.redhat.com/errata/RHSA-2009:1530

Open the full advisory

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2009-3376 (GCVE-0-2009-3376)

Description

Solution

Description

Solution

Description

Solution

Description

Solution

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour