Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-2477 | First vendor Publication | 2009-07-15 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2477 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
SAINT Exploits
| Description | Link |
|---|---|
| Mozilla Firefox JIT Escape Function Memory Corruption | More info here |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-07-29 | Name : Fedora Core 11 FEDORA-2009-7898 (firefox) File : nvt/fcore_2009_7898.nasl |
| 2009-07-29 | Name : FreeBSD Ports: firefox35 File : nvt/freebsd_firefox350.nasl |
| 2009-07-17 | Name : Mozilla Firefox JavaScript Compiler Code Execution Vulnerability (Linux) File : nvt/gb_firefox_js_compiler_code_exec_vuln_lin.nasl |
| 2009-07-17 | Name : Mozilla Firefox JavaScript Compiler Code Execution Vulnerability (Win) File : nvt/gb_firefox_js_compiler_code_exec_vuln_win.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 55846 | Mozilla Firefox Just-in-time (JIT) JavaScript Compiler js/src/jstracer.cpp fo... A memory corruption flaw exists in Firefox. The Just-in-Time (JIT) compiler can enter a corrupt state following native function calls resulting in memory corruption. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Possible generic javascript heap spray attempt RuleID : 20137 - Revision : 12 - Type : INDICATOR-OBFUSCATION |
| 2014-01-10 | Possible generic javascript heap spray attempt RuleID : 18168 - Revision : 14 - Type : INDICATOR-SHELLCODE |
| 2014-01-10 | Possible generic javascript heap spray attempt RuleID : 18167 - Revision : 14 - Type : INDICATOR-SHELLCODE |
| 2014-01-10 | Mozilla Firefox JIT escape function memory corruption attempt RuleID : 15997 - Revision : 11 - Type : BROWSER-FIREFOX |
| 2014-01-10 | Possible generic javascript heap spray attempt RuleID : 15698 - Revision : 15 - Type : INDICATOR-SHELLCODE |
| 2014-01-10 | Mozilla Firefox 3.5 TraceMonkey JavaScript engine uninitialized memory corrup... RuleID : 15696 - Revision : 4 - Type : SPECIFIC-THREATS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-01-08 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO |
| 2009-07-23 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-7898.nasl - Type : ACT_GATHER_INFO |
| 2009-07-20 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_c1ef9b3372a611de82ea0030843d3802.nasl - Type : ACT_GATHER_INFO |
| 2009-07-17 | Name : The remote Windows host contains a web browser that is affected by multiple f... File : mozilla_firefox_351.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:10:51 |
|
| 2024-11-28 12:19:25 |
|
| 2021-05-04 12:09:49 |
|
| 2021-04-22 01:10:10 |
|
| 2020-05-23 13:16:53 |
|
| 2020-05-23 00:24:03 |
|
| 2017-09-19 09:23:18 |
|
| 2017-09-03 09:23:30 |
|
| 2016-04-26 18:58:33 |
|
| 2014-02-17 10:50:47 |
|
| 2014-01-19 21:26:00 |
|
| 2013-05-10 23:53:58 |
|
