PT-2009-5408 · Mozilla+1 · Firefox+1

Published 2009-09-09 · Updated 2024-12-12 · CVE-2009-3077

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 3.0.14 Mozilla Firefox 3.5.x versions prior to 3.5.3

Description: The issue is related to a dangling pointer vulnerability, where the software does not properly manage pointers for the columns of a XUL tree element. This allows remote attackers to execute arbitrary code via a crafted HTML document.

Recommendations: For versions prior to 3.0.14, update to version 3.0.14 or later. For 3.5.x versions prior to 3.5.3, update to version 3.5.3 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3077

DSA-1885-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2009:1430

RHSA-2009:1431

RHSA-2009:1432

RHSA-2009_1430

RHSA-2009_1431

RHSA-2010:0153

RHSA-2010:0154

RHSA-2010_0153

RHSA-2010_0154

Affected Products

Firefox

Red Hat

References · 2128

• https://bdu.fstec.ru/vul/2015-02139 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01738 · Security Note
• https://bdu.fstec.ru/vul/2015-02141 · Security Note
• http://novell.com/linux/security/advisories/2009_48_firefox.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01737 · Security Note
• http://redhat.com/support/errata/RHSA-2009-1432.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02144 · Security Note
• http://ubuntu.com/usn/USN-915-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02145 · Security Note
• https://bdu.fstec.ru/vul/2015-02610 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10071-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02140 · Security Note
• https://bdu.fstec.ru/vul/2015-02611 · Security Note