Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.8

Firefox, Thunderbird, SeaMonkey can be fooled by look‑alike URLs

CVE-2009-0652 · published 17 years ago
Summary

Older versions of Firefox (before 3.0.9), Thunderbird (before 2.0.0.21) and SeaMonkey (before 1.1.15) do not block certain box‑drawing characters used in web addresses. Attackers can craft domain names that look like normal URLs, tricking users into visiting malicious sites. Upgrade to the latest versions of these programs to restore full protection against spoofed URLs.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox <= 3.0.6
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.5
1.5.0.1
38 more version ranges
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozilla seamonkey <= 1.1.14
1.0
1.0.1
1.0.2
1.0.3
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.1
1.1.1
12 more version ranges
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
mozilla thunderbird <= 2.0.0.20
2.0.0.0
2.0.0.4
2.0.0.5
2.0.0.6
2.0.0.9
2.0.0.12
2.0.0.14
2.0.0.16
2.0.0.17
2.0.0.18
2.0.0.19
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Original advisory text
The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing ch...
The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by homoglyphs of the / (slash) and ? (question mark) characters in a subdomain of a .cn domain name, a different vulnerability than CVE-2005-0233. NOTE: some third parties claim that 3.0.6 is not affected, but much older versions perhaps are affected.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.8 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published20 Feb 2009
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-0652 · NVD
Track software like this
Free during beta