Lucene search

RedhatCVE-2009-1392

HistoryJun 12, 2009 - 9:30 p.m.

CVE-2009-1392

2009-06-1221:30:00

CWE-94

redhat

web.nvd.nist.gov

cve-2009-1392

mozilla firefox

thunderbird

seamonkey

remote attackers

denial of service

memory corruption

application crash

arbitrary code

security vulnerability

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

8.3

Confidence

High

EPSS

0.941

Percentile

99.2%

JSON

The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsEventStateManager::GetContentState and nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames and ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, related to the atom table, DOM mutation events, and Unicode surrogates; (8) nsHTMLEditor::HideResizers; and (9) nsWindow::SetCursor, related to changing the cursor; and other vectors.

Affected configurations

Nvd

Node

mozillafirefoxMatch3.0

mozillafirefoxMatch3.0alpha

mozillafirefoxMatch3.0beta2

mozillafirefoxMatch3.0.1

mozillafirefoxMatch3.0.2

mozillafirefoxMatch3.0.3

mozillafirefoxMatch3.0.4

mozillafirefoxMatch3.0.5

mozillafirefoxMatch3.0.6

mozillafirefoxMatch3.0.7

mozillafirefoxMatch3.0.8

mozillafirefoxMatch3.0.9

mozillafirefoxMatch3.0.10

mozillaseamonkeyRange≤1.1.16

mozillaseamonkeyMatch1.0

mozillaseamonkeyMatch1.0alpha

mozillaseamonkeyMatch1.0beta

mozillaseamonkeyMatch1.0dev

mozillaseamonkeyMatch1.0alpha

mozillaseamonkeyMatch1.0beta

mozillaseamonkeyMatch1.0.1

mozillaseamonkeyMatch1.0.3

mozillaseamonkeyMatch1.0.4

mozillaseamonkeyMatch1.0.6

mozillaseamonkeyMatch1.0.8

mozillaseamonkeyMatch1.0.9

mozillaseamonkeyMatch1.0.99

mozillaseamonkeyMatch1.1

mozillaseamonkeyMatch1.1alpha

mozillaseamonkeyMatch1.1beta

mozillaseamonkeyMatch1.1.1

mozillaseamonkeyMatch1.1.3

mozillaseamonkeyMatch1.1.5

mozillaseamonkeyMatch1.1.51.1.10

mozillaseamonkeyMatch1.1.6

mozillaseamonkeyMatch1.1.7

mozillaseamonkeyMatch1.1.8

mozillaseamonkeyMatch1.1.9

mozillaseamonkeyMatch1.1.10

mozillaseamonkeyMatch1.1.11

mozillaseamonkeyMatch1.1.12

mozillaseamonkeyMatch1.1.13

mozillaseamonkeyMatch1.1.15

mozillathunderbirdRange≤2.0.0.19

mozillathunderbirdMatch0.1

mozillathunderbirdMatch0.2

mozillathunderbirdMatch0.3

mozillathunderbirdMatch0.4

mozillathunderbirdMatch0.5

mozillathunderbirdMatch0.6

mozillathunderbirdMatch0.7

mozillathunderbirdMatch0.7.1

mozillathunderbirdMatch0.7.2

mozillathunderbirdMatch0.7.3

mozillathunderbirdMatch0.8

mozillathunderbirdMatch0.9

mozillathunderbirdMatch1.0

mozillathunderbirdMatch1.0.1

mozillathunderbirdMatch1.0.2

mozillathunderbirdMatch1.0.3

mozillathunderbirdMatch1.0.4

mozillathunderbirdMatch1.0.5

mozillathunderbirdMatch1.0.5beta

mozillathunderbirdMatch1.0.6

mozillathunderbirdMatch1.0.7

mozillathunderbirdMatch1.0.8

mozillathunderbirdMatch1.5

mozillathunderbirdMatch1.5beta2

mozillathunderbirdMatch1.5.0.1

mozillathunderbirdMatch1.5.0.2

mozillathunderbirdMatch1.5.0.3

mozillathunderbirdMatch1.5.0.4

mozillathunderbirdMatch1.5.0.5

mozillathunderbirdMatch1.5.0.6

mozillathunderbirdMatch1.5.0.7

mozillathunderbirdMatch1.5.0.8

mozillathunderbirdMatch1.5.0.9

mozillathunderbirdMatch1.5.0.10

mozillathunderbirdMatch1.5.0.11

mozillathunderbirdMatch1.5.0.12

mozillathunderbirdMatch1.5.0.13

mozillathunderbirdMatch1.5.0.14

mozillathunderbirdMatch1.5.1

mozillathunderbirdMatch1.5.2

mozillathunderbirdMatch1.7.1

mozillathunderbirdMatch1.7.3

mozillathunderbirdMatch2.0.0.0

mozillathunderbirdMatch2.0.0.1

mozillathunderbirdMatch2.0.0.2

mozillathunderbirdMatch2.0.0.3

mozillathunderbirdMatch2.0.0.4

mozillathunderbirdMatch2.0.0.5

mozillathunderbirdMatch2.0.0.6

mozillathunderbirdMatch2.0.0.7

mozillathunderbirdMatch2.0.0.8

mozillathunderbirdMatch2.0.0.9

mozillathunderbirdMatch2.0.0.11

mozillathunderbirdMatch2.0.0.12

mozillathunderbirdMatch2.0.0.13

mozillathunderbirdMatch2.0.0.14

mozillathunderbirdMatch2.0.0.15

mozillathunderbirdMatch2.0.0.16

mozillathunderbirdMatch2.0.0.17

mozillathunderbirdMatch2.0.0.18

mozillathunderbirdMatch2.0_.4

mozillathunderbirdMatch2.0_.5

mozillathunderbirdMatch2.0_.6

mozillathunderbirdMatch2.0_.9

mozillathunderbirdMatch2.0_.12

mozillathunderbirdMatch2.0_.13

mozillathunderbirdMatch2.0_.14

mozillathunderbirdMatch2.0_8

VendorProductVersionCPE
mozillafirefox3.0cpe:/a:mozilla:firefox:3.0:beta2::
mozillaseamonkey1.1.5cpe:/a:mozilla:seamonkey:1.1.5:::
mozillaseamonkey1.1.6cpe:/a:mozilla:seamonkey:1.1.6:::
mozillathunderbird2.0.0.17cpe:/a:mozilla:thunderbird:2.0.0.17:::
mozillaseamonkey1.1.9cpe:/a:mozilla:seamonkey:1.1.9:::
mozillathunderbird1.5.0.13cpe:/a:mozilla:thunderbird:1.5.0.13:::
mozillafirefox3.0.6cpe:/a:mozilla:firefox:3.0.6:::
mozillathunderbird1.5.0.10cpe:/a:mozilla:thunderbird:1.5.0.10:::
mozillaseamonkey1.1.11cpe:/a:mozilla:seamonkey:1.1.11:::
mozillathunderbird2.0+.14cpe:/a:mozilla:thunderbird:2.0+.14:::

Vendor	Product	Version	CPE
mozilla	firefox	3.0	cpe:/a:mozilla:firefox:3.0:beta2::
mozilla	seamonkey	1.1.5	cpe:/a:mozilla:seamonkey:1.1.5:::
mozilla	seamonkey	1.1.6	cpe:/a:mozilla:seamonkey:1.1.6:::
mozilla	thunderbird	2.0.0.17	cpe:/a:mozilla:thunderbird:2.0.0.17:::
mozilla	seamonkey	1.1.9	cpe:/a:mozilla:seamonkey:1.1.9:::
mozilla	thunderbird	1.5.0.13	cpe:/a:mozilla:thunderbird:1.5.0.13:::
mozilla	firefox	3.0.6	cpe:/a:mozilla:firefox:3.0.6:::
mozilla	thunderbird	1.5.0.10	cpe:/a:mozilla:thunderbird:1.5.0.10:::
mozilla	seamonkey	1.1.11	cpe:/a:mozilla:seamonkey:1.1.11:::
mozilla	thunderbird	2.0+.14	cpe:/a:mozilla:thunderbird:2.0+.14:::

Rows per page:

1-10 of 1091

References

osvdb.org/55144

osvdb.org/55145

osvdb.org/55146

osvdb.org/55147

rhn.redhat.com/errata/RHSA-2009-1096.html

secunia.com/advisories/35331

secunia.com/advisories/35415

secunia.com/advisories/35428

secunia.com/advisories/35431

secunia.com/advisories/35439

secunia.com/advisories/35440

secunia.com/advisories/35468

secunia.com/advisories/35536

secunia.com/advisories/35561

secunia.com/advisories/35602

securitytracker.com/id?1022376

slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468

slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408

sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1

sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1

www.debian.org/security/2009/dsa-1820

www.debian.org/security/2009/dsa-1830

www.mandriva.com/security/advisories?name=MDVSA-2009:141

www.mozilla.org/security/announce/2009/mfsa2009-24.html

www.redhat.com/support/errata/RHSA-2009-1125.html

www.redhat.com/support/errata/RHSA-2009-1126.html

www.securityfocus.com/bid/35326

www.securityfocus.com/bid/35370

www.securitytracker.com/id?1022397

www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275

www.ubuntu.com/usn/usn-782-1

www.vupen.com/english/advisories/2009/1572

www.vupen.com/english/advisories/2009/2152

bugzilla.mozilla.org/show_bug.cgi?id=380359

bugzilla.mozilla.org/show_bug.cgi?id=429969

bugzilla.mozilla.org/show_bug.cgi?id=431086

bugzilla.mozilla.org/show_bug.cgi?id=432068

bugzilla.mozilla.org/show_bug.cgi?id=451341

bugzilla.mozilla.org/show_bug.cgi?id=472776

bugzilla.mozilla.org/show_bug.cgi?id=486398

bugzilla.mozilla.org/show_bug.cgi?id=489041

bugzilla.mozilla.org/show_bug.cgi?id=490410

bugzilla.mozilla.org/show_bug.cgi?id=490425

bugzilla.mozilla.org/show_bug.cgi?id=490513

bugzilla.redhat.com/show_bug.cgi?id=503568

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9501

rhn.redhat.com/errata/RHSA-2009-1095.html

www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html

www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

8.3

Confidence

High

EPSS

0.941

Percentile

99.2%

JSON

Related for CVE-2009-1392