CVE-2009-2065: Medium severity Mozilla Firefox vulnerability
Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2065?
CVE-2009-2065 has a high severity rating as it allows man-in-the-middle attackers to execute arbitrary web scripts in an HTTPS context.
How do I fix CVE-2009-2065?
To fix CVE-2009-2065, upgrade to a version of Mozilla Firefox that is not affected by this vulnerability.
What versions of Firefox are affected by CVE-2009-2065?
CVE-2009-2065 affects Mozilla Firefox versions up to and including 3.0.9 as well as earlier versions.
What type of attack does CVE-2009-2065 enable?
CVE-2009-2065 enables man-in-the-middle attacks, allowing arbitrary script execution from HTTP content within HTTPS pages.
Is CVE-2009-2065 a common vulnerability?
Yes, CVE-2009-2065 is recognized as a significant vulnerability affecting various versions of Firefox.