PT-2009-6651 · Mozilla+1 · Libnspr4-0D-Dbg+10

Monarch2020 · Published 1970-01-01 · Updated 2018-10-30 · CVE-2009-2463

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libnspr4-0d versions (affected versions not specified) libmozjs-dev versions (affected versions not specified) libnspr4-0d-dbg versions (affected versions not specified) libmozjs1d-dbg versions (affected versions not specified) libmozjs1d versions (affected versions not specified) libnspr4-dev versions (affected versions not specified) libmozillainterfaces-java versions (affected versions not specified) Mozilla Firefox versions prior to 3.0.12 Thunderbird versions prior to 2.0.0.24 SeaMonkey versions prior to 1.1.19

Description The issue involves multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libnspr4-0d, libmozjs-dev, libnspr4-0d-dbg, libmozjs1d-dbg, libmozjs1d, libnspr4-dev, and libmozillainterfaces-java. These vulnerabilities can be exploited remotely, leading to a disruption in the confidentiality, integrity, and availability of protected information. Additionally, integer overflows in the PL Base64Decode and PL Base64Encode functions in Mozilla Firefox, Thunderbird, and SeaMonkey can cause a denial of service or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.

Recommendations For libnspr4-0d, consider disabling the vulnerable functions until a patch is available. For libmozjs-dev, restrict access to the vulnerable module to minimize the risk of exploitation. For libnspr4-0d-dbg, avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved. For libmozjs1d-dbg, consider disabling the vulnerable function until a patch is available. For libmozjs1d, restrict access to the vulnerable module to minimize the risk of exploitation. For libnspr4-dev, avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved. For libmozillainterfaces-java, consider disabling the vulnerable function until a patch is available. For Mozilla Firefox, update to version 3.0.12 or later. For Thunderbird, update to version 2.0.0.24 or later. For SeaMonkey, update to version 1.1.19 or later.

Fix

DoS

Weakness Enumeration

CWE-399

CWE-189

Related Identifiers

BDU:2015-01736

BDU:2015-01737

BDU:2015-01738

BDU:2015-01739

BDU:2015-02139

BDU:2015-02140

BDU:2015-02141

CVE-2009-2463

DSA-1931-1

DSA-2025-1

RHSA-2009:1162

RHSA-2009:1163

RHSA-2009_1162

RHSA-2009_1163

RHSA-2010:0153

RHSA-2010:0154

RHSA-2010_0153

RHSA-2010_0154

Affected Products

Firefox

Red Hat

Seamonkey

Thunderbird

Libmozillainterfaces-Java

Libmozjs-Dev

Libmozjs1D

Libmozjs1D-Dbg

Libnspr4-0D

Libnspr4-0D-Dbg

Libnspr4-Dev

References · 92

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2472 · Security Note
• http://vupen.com/english/advisories/2009/1972 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02147 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2464 · Security Note
• https://osv.dev/vulnerability/CVE-2009-2463 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html · Vendor Advisory
• http://secunia.com/advisories/35914 · Vendor Advisory
• http://secunia.com/advisories/35947 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2469 · Security Note
• http://securityfocus.com/bid/35758 · Patch
• http://redhat.com/support/errata/RHSA-2010-0154.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2467 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2463 · Security Note
• http://rhn.redhat.com/errata/RHSA-2009-1162.html · Vendor Advisory