CVE catalog

CVE-2009-0652

icedove - several vulnerabilities

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.50% · Oct 25, 2026

The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by homoglyphs of the / (slash) and ? (question mark) characters in a subdomain of a .cn domain name, a different vulnerability than CVE-2005-0233. NOTE: some third parties claim that 3.0.6 is not affected, but much older versions perhaps are affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxulrunner5.01.9.0.5-1vulnerable
Debianxulrunner5.01.9.0.6-1vulnerable
Debianxulrunner5.01.9.0.7-0lenny1vulnerable
Debianxulrunner5.01.9.0.7-0lenny2vulnerable
Debianxulrunner5.01.9.0.7-1vulnerable
Debianxulrunner5.01.9.0.8-1vulnerable
Debianxulrunner5.01.9.0.9-0lenny2fixed
Debianicedove5.02.0.0.19-1vulnerable
Debianicedove5.02.0.0.19-1+kbsdvulnerable
Debianicedove5.02.0.0.22-0lenny1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxulrunnerdeb5.01.9.0.9-0lenny2Not reportedDSA-1797-1Not reported
Debianicedovedeb5.02.0.0.22-0lenny1Not reportedDSA-1830-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]