PT-2009-6658 · Mozilla+1 · Libmozjs1D-Dbg+5

Blake Kaplan · Published 1970-01-01 · Updated 2017-09-19 · CVE-2009-2471

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libmozjs1d-dbg versions (affected versions not specified) libmozjs1d versions (affected versions not specified) libmozjs-dev versions (affected versions not specified) Mozilla Firefox versions prior to 3.0.12 libmozillainterfaces-java versions (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libmozjs1d-dbg, libmozjs1d, libmozjs-dev, and libmozillainterfaces-java. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Additionally, a specific vulnerability in Mozilla Firefox before version 3.0.12 allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call to the setTimeout function, related to XPCNativeWrapper.

Recommendations For libmozjs1d-dbg, consider updating to a version that includes the necessary security patches. For libmozjs1d, consider updating to a version that includes the necessary security patches. For libmozjs-dev, consider updating to a version that includes the necessary security patches. For Mozilla Firefox, update to version 3.0.12 or later to address the vulnerability in the setTimeout function. For libmozillainterfaces-java, consider updating to a version that includes the necessary security patches. As a temporary workaround, consider restricting access to the vulnerable packages until a patch is available.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-01736

BDU:2015-01737

BDU:2015-01738

BDU:2015-01739

CVE-2009-2471

DSA-1840-1

RHSA-2009:1162

RHSA-2009_1162

Affected Products

Firefox

Red Hat

Libmozillainterfaces-Java

Libmozjs-Dev

Libmozjs1D

Libmozjs1D-Dbg

References · 45

• http://secunia.com/advisories/35914 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2463 · Security Note
• http://mozilla.org/security/announce/2009/mfsa2009-39.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01739 · Security Note
• https://bdu.fstec.ru/vul/2015-02141 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2469 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2466 · Security Note
• https://bdu.fstec.ru/vul/2015-02140 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/1972 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01738 · Security Note
• https://bdu.fstec.ru/vul/2015-02139 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-July/msg01032.html · Vendor Advisory
• http://securityfocus.com/bid/35758 · Patch