CVE-2009-1169

Published: Mar 27, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XML file with a crafted XSLT transform.

Affected (99)

Products: Mozilla: Firefox

Mozilla

1 product

Firefox

Configuration A

99 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.0.7
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.1
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.3
Mozilla Firefox	Version 0.4
Mozilla Firefox	Version 0.5
Mozilla Firefox	Version 0.6.1
Mozilla Firefox	Version 0.6
Mozilla Firefox	Version 0.7.1
Mozilla Firefox	Version 0.7
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 0.9_rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.0 preview_release
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 1.8
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.17
Mozilla Firefox	Version 2.0.0.18
Mozilla Firefox	Version 2.0.0.19
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.20
Mozilla Firefox	Version 2.0.0.21
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta1
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3
Mozilla Firefox	Version 2.0_.10
Mozilla Firefox	Version 2.0_.1
Mozilla Firefox	Version 2.0_.4
Mozilla Firefox	Version 2.0_.5
Mozilla Firefox	Version 2.0_.6
Mozilla Firefox	Version 2.0_.7
Mozilla Firefox	Version 2.0_.9
Mozilla Firefox	Version 2.0_8
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0.6
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.0 alpha
Mozilla Firefox	Version 3.0 beta2
Mozilla Firefox	Version 3.0 beta5
Mozilla Firefox	Version 3.0beta5

Related CWEs

CWE-399

References (64)

http://blogs.zdnet.com/security/?p=3013

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html

Source: secalert@redhat.com

Patch

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html

Source: secalert@redhat.com

Patch

http://secunia.com/advisories/34471

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34486

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34505

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34510

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34511

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34521

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34527

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34549

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34550

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34792

Source: secalert@redhat.com

Vendor Advisory

http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1756

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:084

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2009/mfsa2009-12.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2009-0397.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-0398.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/34235

Source: secalert@redhat.com

ExploitPatch

http://www.securitytracker.com/id?1021939

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-745-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0853

Source: secalert@redhat.com

PatchVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=460090

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=485217

Source: secalert@redhat.com

Patch

https://bugzilla.mozilla.org/show_bug.cgi?id=485286

Source: secalert@redhat.com

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/49439

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11372

Source: secalert@redhat.com

https://www.exploit-db.com/exploits/8285

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01023.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01040.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html

Source: secalert@redhat.com

http://blogs.zdnet.com/security/?p=3013