CVE-2009-2466: mozilla firefox Out-of-bounds Write
Vulnerability summary
CVE-2009-2466 is a high (CVSS 10.0) Out-of-bounds Write vulnerability in mozilla firefox. EPSS estimates a 6.62% chance of exploitation in the next 30 days, higher than 93.8% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5Timeline
- 22-07-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsDOMClassInfo.cpp, (2) JS_HashTableRawLookup, and (3) MirrorWrappedNativeParent and js_LockGCThingRT.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
6.62%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 6.62% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (bugzilla.mozilla.org)
Maturity: unknown
Exploit Reference (bugzilla.mozilla.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Mozilla2 products
- firefox< 3.0.12
- thunderbird≤ 3.0.11
1 vendor · 2 products
References
25 links- sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1Vendor AdvisoryX Refsource SUNALERTBroken Link
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9820VDB EntrySignatureX Refsource OVALBroken Link
- sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1Vendor AdvisoryX Refsource SUNALERTBroken Link
- www.redhat.com/support/errata/RHSA-2010-0153.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2009-July/msg01032.htmlVendor AdvisoryX Refsource FEDORABroken Link
- secunia.com/advisories/35944Third Party AdvisoryX Refsource SECUNIANot ApplicablePatchVendor Advisory
Show all 25 references
- lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.htmlVendor AdvisoryX Refsource SUSEBroken Link
- www.redhat.com/support/errata/RHSA-2010-0154.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.htmlVendor AdvisoryX Refsource SUSEBroken Link