PT-2009-2773 · Mozilla · Firefox

Skylined · Published 2009-01-08 · Updated 2017-09-29 · CVE-2009-0071

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.0.5 and earlier 3.0.x Mozilla Firefox versions 3.0.6 and 3.0.7

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash. This can be achieved through specific function calls, including replaceChild or removeChild, followed by queryCommandValue, queryCommandState, or queryCommandIndeterm calls, when designMode is enabled.

Recommendations For Mozilla Firefox versions 3.0.5 and earlier 3.0.x, consider disabling the designMode feature to prevent exploitation until a patch is available. For Mozilla Firefox versions 3.0.6 and 3.0.7, consider disabling the designMode feature to prevent exploitation until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0071

Affected Products

Firefox

References · 10

• 🔥 http://securityfocus.com/bid/33154 · Exploit
• 🔥 https://exploit-db.com/exploits/8219 · Exploit
• 🔥 https://exploit-db.com/exploits/8091 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0071 · Security Note
• http://archives.neohapsis.com/archives/fulldisclosure/2009-01/0220.html · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2009-01/0224.html · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=456727 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=472507 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2009-01/0223.html · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=448329 · Note