Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Firefox < 3.0.10 can be fooled into loading malicious pages

CVE-2009-2061 · published 17 years ago
Summary

Older versions of Firefox may accept a special network reply that redirects users to any secure website before the secure connection is fully set up. This lets an attacker who can intercept traffic insert harmful code that runs in the context of a trusted site. Upgrade Firefox to version 3.0.10 or later, or switch to a current browser, to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox <= 3.0.9
0.1
0.2
0.3
0.4
0.5
0.6
0.6.1
0.7
0.7.1
0.8
0.9
67 more version ranges
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Original advisory text
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's c...
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-310Cryptographic Issues
Timeline
Published15 Jun 2009
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-2061 · NVD
Track software like this
Free during beta