PT-2009-6687 · Mozilla+2 · Firefox+5

Dan Kaminsky · Published 1970-01-01 · Updated 2024-06-15 · CVE-2009-3379

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libvorbisfile3 (affected versions not specified) libvorbis0a (affected versions not specified) libvorbis-dev (affected versions not specified) libvorbisenc2 (affected versions not specified) Mozilla Firefox versions prior to 3.5.4

Description The issue involves multiple unspecified vulnerabilities in the libvorbis package, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely, potentially causing a denial of service or allowing the execution of arbitrary code. The estimated number of potentially affected devices worldwide is not available.

Recommendations For libvorbisfile3, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libvorbis0a, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libvorbis-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For libvorbisenc2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Mozilla Firefox, update to version 3.5.4 or later to resolve the issue.

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-02642

BDU:2015-02643

BDU:2015-02644

BDU:2015-02645

CVE-2009-3379

DSA-1939-1

OPENSUSE-SU-2024:10024-1

OPENSUSE-SU-2024:10071-1

RHSA-2009:1561

RHSA-2009_1561

Affected Products

Firefox

Red Hat

Libvorbis-Dev

Libvorbis0A

Libvorbisenc2

Libvorbisfile3

References · 932

• https://redhat.com/archives/fedora-package-announce/2009-November/msg00369.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3379 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3379 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1561.html · Vendor Advisory
• http://ubuntu.com/usn/USN-861-1 · Vendor Advisory
• http://mozilla.org/security/announce/2009/mfsa2009-63.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02642 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-November/msg00315.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02645 · Security Note
• https://osv.dev/vulnerability/CVE-2009-3379 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02643 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02644 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2663 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=500254 · Patch