CVE-2009-1571

Published: Feb 22, 2010Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Use-after-free vulnerability in the HTML parser in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to execute arbitrary code via unspecified method calls that attempt to access freed objects in low-memory situations.

Affected (67)

Products: Mozilla: Firefox, Seamonkey

2 products

Configuration A

67 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 3.0.10
Mozilla Firefox	Version 3.0.11
Mozilla Firefox	Version 3.0.12
Mozilla Firefox	Version 3.0.13
Mozilla Firefox	Version 3.0.14
Mozilla Firefox	Version 3.0.15
Mozilla Firefox	Version 3.0.17
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0.6
Mozilla Firefox	Version 3.0.7
Mozilla Firefox	Version 3.0.8
Mozilla Firefox	Version 3.0.9
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.0 alpha
Mozilla Firefox	Version 3.0 beta2
Mozilla Firefox	Version 3.0 beta5
Mozilla Firefox	Version 3.5.1
Mozilla Firefox	Version 3.5.2
Mozilla Firefox	Version 3.5.3
Mozilla Firefox	Version 3.5.4
Mozilla Firefox	Version 3.5.5
Mozilla Firefox	Version 3.5.6
Mozilla Firefox	Version 3.5.7
Mozilla Firefox	Version 3.5
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.14
Mozilla Seamonkey	Version 1.1.15
Mozilla Seamonkey	Version 1.1.16
Mozilla Seamonkey	Version 1.1.17
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 2.0.1
Mozilla Seamonkey	Version 2.0.2
Mozilla Seamonkey	Version 2.0
Mozilla Seamonkey	Version 2.0 alpha_2
Mozilla Seamonkey	Version 2.0 alpha_3
Mozilla Seamonkey	Version 2.0 beta_1
Mozilla Seamonkey	Version 2.0 beta_2
Mozilla Seamonkey	Version 2.0 rc1
Mozilla Seamonkey	Version 2.0 rc2

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (56)

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html

Source: PSIRT-CNA@flexerasoftware.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html

Source: PSIRT-CNA@flexerasoftware.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html

Source: PSIRT-CNA@flexerasoftware.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036097.html

Source: PSIRT-CNA@flexerasoftware.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036132.html

Source: PSIRT-CNA@flexerasoftware.com

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html

Source: PSIRT-CNA@flexerasoftware.com

http://secunia.com/advisories/37242

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://secunia.com/advisories/38770

Source: PSIRT-CNA@flexerasoftware.com

http://secunia.com/advisories/38772

Source: PSIRT-CNA@flexerasoftware.com

http://secunia.com/advisories/38847

Source: PSIRT-CNA@flexerasoftware.com

http://secunia.com/secunia_research/2009-45/

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://www.debian.org/security/2010/dsa-1999

Source: PSIRT-CNA@flexerasoftware.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:042

Source: PSIRT-CNA@flexerasoftware.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:051

Source: PSIRT-CNA@flexerasoftware.com

http://www.mozilla.org/security/announce/2010/mfsa2010-03.html

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2010-0112.html

Source: PSIRT-CNA@flexerasoftware.com

http://www.redhat.com/support/errata/RHSA-2010-0113.html

Source: PSIRT-CNA@flexerasoftware.com

http://www.redhat.com/support/errata/RHSA-2010-0153.html

Source: PSIRT-CNA@flexerasoftware.com

http://www.redhat.com/support/errata/RHSA-2010-0154.html

Source: PSIRT-CNA@flexerasoftware.com

http://www.securityfocus.com/archive/1/509585/100/0/threaded

Source: PSIRT-CNA@flexerasoftware.com

http://www.ubuntu.com/usn/USN-895-1

Source: PSIRT-CNA@flexerasoftware.com

http://www.ubuntu.com/usn/USN-896-1

Source: PSIRT-CNA@flexerasoftware.com

http://www.vupen.com/english/advisories/2010/0405

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/0650

Source: PSIRT-CNA@flexerasoftware.com

https://bugzilla.mozilla.org/show_bug.cgi?id=526500

Source: PSIRT-CNA@flexerasoftware.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/56361

Source: PSIRT-CNA@flexerasoftware.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11227

Source: PSIRT-CNA@flexerasoftware.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8615

Source: PSIRT-CNA@flexerasoftware.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036097.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036132.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37242

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/38770

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/38772

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/38847

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/secunia_research/2009-45/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.debian.org/security/2010/dsa-1999

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2010:042

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2010:051

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2010/mfsa2010-03.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2010-0112.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2010-0113.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2010-0153.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2010-0154.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/509585/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-895-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-896-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/0405

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2010/0650

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=526500

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/56361

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11227

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8615

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.