CVE-2009-1836: Mozilla Firefox

Medium severity, CVSS 6.8. EPSS: 2% chance of exploitation in the next 30 days.

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.

Affected products

• Mozilla Firefox: up to and including 3.0.10; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …
• Mozilla Seamonkey: up to and including 1.1.16; version 1.0 only; version 1.0.1 only; version 1.0.3 only; version 1.0.4 only; version 1.0.6 only; …
• Mozilla Thunderbird: up to and including 2.0.0.19; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2009-06-12. Last modified 2026-06-16.