NetSight
IP …
critical9.3

CVE-2009-3376

Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode c…

Impact

Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.

Affected products

VendorProductAffected versions
MozillaFirefox
Versions 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5
MozillaSeamonkey
through 1.5.0.10
Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4

Weakness classification

CWE-16

References