CVEvulnerability

CVE-2009-0689

6.8 MEDIUM Published 2009-07-01 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-07-01
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-119

Description

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

Affected configurations

• k-meleon project k-meleon 1.5.3 • mozilla firefox 3.0.1 • mozilla firefox 3.0.2 • mozilla firefox 3.0.3 • mozilla firefox 3.0.4 • mozilla firefox 3.0.5 • mozilla firefox 3.0.6 • mozilla firefox 3.0.7 • mozilla firefox 3.0.8 • mozilla firefox 3.0.9 • mozilla firefox 3.0.10 • mozilla firefox 3.0.11 • mozilla firefox 3.0.12 • mozilla firefox 3.0.13 • mozilla firefox 3.0.14 • mozilla firefox 3.5 • mozilla firefox 3.5.1 • mozilla firefox 3.5.2 • mozilla firefox 3.5.3 • mozilla seamonkey 1.1.8 • freebsd freebsd 6.4 • freebsd freebsd 7.2 • netbsd netbsd 5.0 • openbsd openbsd 4.5

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

Referenced by CWE · observed example (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-788 Access of Memory Location After End of Buffer weakness

References