CVEvulnerability
CVE-2009-2477
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-07-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-94
Description
js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.
Affected configurations
• mozilla firefox 3.5
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/ blog.mozilla.com
- http://isc.sans.org/diary.html?storyid=6796 isc.sans.org
- http://secunia.com/advisories/35798 Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1 sunsolve.sun.com
- http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html voices.washingtonpost.com
- http://www.exploit-db.com/exploits/9137 www.exploit-db.com
- http://www.exploit-db.com/exploits/9181 www.exploit-db.com
- http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761 www.h-online.com
- http://www.kb.cert.org/vuls/id/443060 US Government Resource
- http://www.mozilla.org/security/announce/2009/mfsa2009-41.html Patch, Vendor Advisory
- http://www.securityfocus.com/bid/35660 Exploit
- http://www.vupen.com/english/advisories/2009/1868 Patch, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=503286 bugzilla.mozilla.org
- https://www.exploit-db.com/exploits/40936/ www.exploit-db.com
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html www.redhat.com
- http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/ blog.mozilla.com
- http://isc.sans.org/diary.html?storyid=6796 isc.sans.org
- http://secunia.com/advisories/35798 Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1 sunsolve.sun.com
- http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html voices.washingtonpost.com
- http://www.exploit-db.com/exploits/9137 www.exploit-db.com
- http://www.exploit-db.com/exploits/9181 www.exploit-db.com
- http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761 www.h-online.com
- http://www.kb.cert.org/vuls/id/443060 US Government Resource
- http://www.mozilla.org/security/announce/2009/mfsa2009-41.html Patch, Vendor Advisory
- http://www.securityfocus.com/bid/35660 Exploit
- http://www.vupen.com/english/advisories/2009/1868 Patch, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=503286 bugzilla.mozilla.org
- https://www.exploit-db.com/exploits/40936/ www.exploit-db.com
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html www.redhat.com