PT-2009-6654 · Mozilla+1 · Thunderbird+6

Yongqian · Published 1970-01-01 · Updated 2018-10-30 · CVE-2009-2465

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libmozjs1d-dbg versions (affected versions not specified) libmozjs1d versions (affected versions not specified) libmozjs-dev versions (affected versions not specified) libmozillainterfaces-java versions (affected versions not specified) Mozilla Firefox versions prior to 3.0.12 Thunderbird versions (affected versions not specified)

Description The issue involves multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libmozjs1d-dbg, libmozjs1d, libmozjs-dev, and libmozillainterfaces-java. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. In the case of Mozilla Firefox and Thunderbird, the vulnerabilities can cause a denial of service (memory corruption and application crash) or allow the execution of arbitrary code via specific vectors, including double frame construction and related functions such as nsSubDocumentFrame::Reflow.

Recommendations For libmozjs1d-dbg, consider disabling the package until a patch is available. For libmozjs1d, restrict access to the package to minimize the risk of exploitation. For libmozjs-dev, avoid using the package in development environments until the issue is resolved. For libmozillainterfaces-java, restrict access to the package to minimize the risk of exploitation. For Mozilla Firefox versions prior to 3.0.12, update to version 3.0.12 or later to resolve the issue. For Thunderbird, update to a version that includes the fix for the vulnerability, although the specific version is not specified. At the moment, there is no information about a newer version that contains a fix for libmozjs1d-dbg, libmozjs1d, libmozjs-dev, libmozillainterfaces-java, and Thunderbird.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-01736

BDU:2015-01737

BDU:2015-01738

BDU:2015-01739

CVE-2009-2465

DSA-1840-1

RHSA-2009:1162

RHSA-2009_1162

Affected Products

Firefox

Red Hat

Thunderbird

Libmozillainterfaces-Java

Libmozjs-Dev

Libmozjs1D

Libmozjs1D-Dbg

References · 50

• http://secunia.com/advisories/35914 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2463 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01739 · Security Note
• https://bdu.fstec.ru/vul/2015-02141 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2469 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2466 · Security Note
• https://bdu.fstec.ru/vul/2015-02140 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/1972 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01738 · Security Note
• https://bdu.fstec.ru/vul/2015-02139 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-July/msg01032.html · Vendor Advisory
• http://securityfocus.com/bid/35758 · Patch