CVE-2009-1392

CVSS V2 High 9.3 CVSS V3 None

Description

The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsEventStateManager::GetContentState and nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames and ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, related to the atom table, DOM mutation events, and Unicode surrogates; (8) nsHTMLEditor::HideResizers; and (9) nsWindow::SetCursor, related to changing the cursor; and other vectors.

Overview

CVE ID
CVE-2009-1392

Assigner
secalert@redhat.com

Vulnerability Status
Modified

Published Version
2009-06-12T21:30:00

Last Modified Date
2018-10-30T16:25:58

Weakness Enumerations

CWE	URL
CWE-94	http://cwe.mitre.org/data/definitions/94.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
cpe:2.3:a:mozilla:firefox:3.0:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0:alpha::::::	1	OR
cpe:2.3:a:mozilla:firefox:3.0:beta2::::::	1	OR
cpe:2.3:a:mozilla:firefox:3.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.9:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.10:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey::::::::	1	OR	1.1.16
cpe:2.3:a:mozilla:seamonkey:1.0:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0::alpha:::::	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0::beta:::::	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0::dev:::::	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0:alpha::::::	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0:beta::::::	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0.9:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.0.99:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1:alpha::::::	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1:beta::::::	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.1:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.3:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.5:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.5:1.1.10::::::	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.6:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.7:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.8:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.9:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.10:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.11:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.12:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.13:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey:1.1.15:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird::::::::	1	OR	2.0.0.19
cpe:2.3:a:mozilla:thunderbird:0.1:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.2:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.3:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.4:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.5:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.6:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.7:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.7.1:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.7.2:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.7.3:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.8:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:0.9:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.5:beta::::::	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5:beta2::::::	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.9:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.10:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.11:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.12:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.13:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.0.14:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.1:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.5.2:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.7.1:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:1.7.3:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.0:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.9:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.11:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.12:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.13:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.14:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.15:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.16:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.17:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0.0.18:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0_.4:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0_.5:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0_.6:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0_.9:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0_.12:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0_.13:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0_.14:::::::*	1	OR
cpe:2.3:a:mozilla:thunderbird:2.0_8:::::::*	1	OR

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector
NETWORK

Access Compatibility
MEDIUM

Authentication
NONE

Confidentiality Impact
COMPLETE

Integrity Impact
COMPLETE

Availability Impact
COMPLETE

Base Score
9.3

Severity
HIGH

Exploitability Score
8.6

Impact Score
10

References

Reference URL	Reference Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=490425
https://bugzilla.mozilla.org/show_bug.cgi?id=490410	Exploit
http://www.securityfocus.com/bid/35326
https://bugzilla.mozilla.org/show_bug.cgi?id=429969	Exploit
http://www.mozilla.org/security/announce/2009/mfsa2009-24.html	Vendor Advisory
http://secunia.com/advisories/35331	Vendor Advisory
http://secunia.com/advisories/35431	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=380359	Exploit
https://bugzilla.mozilla.org/show_bug.cgi?id=451341	Exploit
https://bugzilla.mozilla.org/show_bug.cgi?id=490513	Exploit
https://bugzilla.mozilla.org/show_bug.cgi?id=472776	Exploit
http://secunia.com/advisories/35440	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=431086	Exploit
https://bugzilla.mozilla.org/show_bug.cgi?id=432068	Exploit
https://bugzilla.mozilla.org/show_bug.cgi?id=486398	Exploit
https://bugzilla.mozilla.org/show_bug.cgi?id=489041	Exploit
http://secunia.com/advisories/35428	Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2009-1095.html	Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=503568	Exploit
http://securitytracker.com/id?1022376	Patch
http://secunia.com/advisories/35439	Vendor Advisory
http://www.vupen.com/english/advisories/2009/1572	Patch Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2009-1096.html	Patch Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html
http://www.securityfocus.com/bid/35370
http://www.securitytracker.com/id?1022397
http://osvdb.org/55145
http://osvdb.org/55147
http://osvdb.org/55144
http://osvdb.org/55146
http://www.debian.org/security/2009/dsa-1820
http://secunia.com/advisories/35468
http://www.redhat.com/support/errata/RHSA-2009-1125.html
http://www.ubuntu.com/usn/usn-782-1
http://www.redhat.com/support/errata/RHSA-2009-1126.html
http://secunia.com/advisories/35536
http://secunia.com/advisories/35602
http://www.mandriva.com/security/advisories?name=MDVSA-2009:141
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408
http://secunia.com/advisories/35561
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468
http://secunia.com/advisories/35415
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275
http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1
http://www.vupen.com/english/advisories/2009/2152
http://www.debian.org/security/2009/dsa-1830
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9501

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2009-1392
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1392

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 18:00:23				Added to TrackCVE