CVE-2009-1839: mozilla firefox

Modified

Published 12-06-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-1839 is a medium (CVSS 5.4) vulnerability in mozilla firefox. EPSS estimates a 7.12% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 18-12-2009)

Source freshness unavailable

How is this decided?

CVSS score

5.4/10

010

Medium · v2.0 (NVD)

EPSS score

7.12%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 2

DSA-1820-1 RHSA-2009:1095

Timeline

12-06-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded through the location bar, which allows user-assisted remote attackers to bypass intended access restrictions and read files via a crafted HTML document, aka a "file-URL-to-file-URL scripting" attack.

CVSS metrics

1 score · 1 source · 1 version

v2.05.4

EPSS trend

Probability

7.12%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 7.12% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databaselocalmultipleVerified
Mozilla Firefox - Location Bar Spoofing
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Mozilla1 product

firefox≤ 3.0.10 | 3.0 | 3.0:alpha | 3.0:beta2 | 3.0:beta5 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.0.5 | 3.0.6 | 3.0.7 | 3.0.8 | 3.0.9 | 3.0beta5 | 3.1:beta1

1 vendor · 1 product

References

18 links

bugzilla.mozilla.org/show_bug.cgi?id=479943X Refsource CONFIRM
www.vupen.com/english/advisories/2009/1572VDB EntryX Refsource VUPENPatchVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=503581X Refsource CONFIRM
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9256VDB EntrySignatureX Refsource OVAL
www.securityfocus.com/bid/35326VDB EntryX Refsource BIDPatch
www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.htmlVendor AdvisoryX Refsource FEDORA
www.mozilla.org/security/announce/2009/mfsa2009-30.htmlX Refsource CONFIRMVendor Advisory
secunia.com/advisories/35431Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/35331Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/35468Third Party AdvisoryX Refsource SECUNIA

Show all 18 references

www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/35415Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2009-1095.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/bid/35386VDB EntryX Refsource BID
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468Vendor AdvisoryX Refsource SLACKWARE
osvdb.org/55163VDB EntryX Refsource OSVDB
www.debian.org/security/2009/dsa-1820Vendor AdvisoryX Refsource DEBIAN
sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1Vendor AdvisoryX Refsource SUNALERT