Unrated severityNVD Advisory· Published Nov 12, 2010· Updated Jun 16, 2026

CVE-2009-5017

Description

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefox3 versions
cpe:2.3:a:mozilla:firefox:3.6:beta1:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:mozilla:firefox:3.6:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:beta2:*:*:*:*:*:*range: <=3.6
- (no CPE)range: <3.6 Beta 3

Patches

Vulnerability mechanics

References

bugzilla.mozilla.org/show_bug.cginvdPatch
sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.htmlnvdExploit
hg.mozilla.org/releases/mozilla-1.9.2/rev/e42c563313a0nvd
bugzilla.mozilla.org/show_bug.cginvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000