CVE-2009-2466

Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 22 Jul 2009, 18:00
Last modified:07 Aug 2024, 05:52

Vulnerability Summary

Overall Risk (default)
critical
90/100
CVSS Score
10 HIGH
v2.0 (nvd)
EPSS Score
5.82% LOW
6% probability +1.45%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

22 Jul 2009, 18:00
Published
Vulnerability first disclosed
07 Aug 2024, 05:52
Last Modified
Vulnerability information updated

Description

The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and (3) MirrorWrappedNativeParent and js_LockGCThingRT.

CVSS Metrics

  • v2.0•HIGH•Score: 10AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 5.82%• Percentile: 91%

Techniques & Countermeasures

  • CWE-787•Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • mozilla•firefox

    < 3.0.12

  • mozilla•thunderbird

    ≤ 3.0.11

References (25)