CVE-2009-3373
NoneCVSS
—
EPSS
15.5%
Published
Oct 29, 2009
CISA due date
—
The record
Heap-based buffer overflow in the GIF image parser in Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows remote attackers to execute arbitrary code via unspecified vectors.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:5.0 | xulrunner | 0 | 1.9.0.15-0lenny1 |
| Red Hat:enterprise_linux:4::as | firefox | 0 | 0:3.0.15-3.el4 |
| Red Hat:enterprise_linux:4::as | firefox-debuginfo | 0 | 0:3.0.15-3.el4 |
| Red Hat:enterprise_linux:4::as | nspr | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::as | nspr-debuginfo | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::as | nspr-devel | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::desktop | firefox | 0 | 0:3.0.15-3.el4 |
| Red Hat:enterprise_linux:4::desktop | firefox-debuginfo | 0 | 0:3.0.15-3.el4 |
| Red Hat:enterprise_linux:4::desktop | nspr | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::desktop | nspr-debuginfo | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::desktop | nspr-devel | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::es | firefox | 0 | 0:3.0.15-3.el4 |
| Red Hat:enterprise_linux:4::es | firefox-debuginfo | 0 | 0:3.0.15-3.el4 |
| Red Hat:enterprise_linux:4::es | nspr | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::es | nspr-debuginfo | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::es | nspr-devel | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::ws | firefox | 0 | 0:3.0.15-3.el4 |
| Red Hat:enterprise_linux:4::ws | firefox-debuginfo | 0 | 0:3.0.15-3.el4 |
| Red Hat:enterprise_linux:4::ws | nspr | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::ws | nspr-debuginfo | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:4::ws | nspr-devel | 0 | 0:4.7.6-1.el4_8 |
| Red Hat:enterprise_linux:5::client | firefox | 0 | 0:3.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client | firefox-debuginfo | 0 | 0:3.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client | nspr | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::client | nspr-debuginfo | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::client | nspr-devel | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::client | xulrunner | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client | xulrunner-debuginfo | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client | xulrunner-devel | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client | xulrunner-devel-unstable | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client_workstation | nspr | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::client_workstation | nspr-debuginfo | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::client_workstation | nspr-devel | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner-debuginfo | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner-devel | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::client_workstation | xulrunner-devel-unstable | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::server | firefox | 0 | 0:3.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::server | firefox-debuginfo | 0 | 0:3.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::server | nspr | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::server | nspr-debuginfo | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::server | nspr-devel | 0 | 0:4.7.6-1.el5_4 |
| Red Hat:enterprise_linux:5::server | xulrunner | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::server | xulrunner-debuginfo | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::server | xulrunner-devel | 0 | 0:1.9.0.15-3.el5_4 |
| Red Hat:enterprise_linux:5::server | xulrunner-devel-unstable | 0 | 0:1.9.0.15-3.el5_4 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 50.1.0-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2011-2371 Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x… Also affects xulrunner
- CVE-2010-3765 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… Also affects xulrunner
- CVE-2010-3179 Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before… Also affects xulrunner
- CVE-2010-1205 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… Also affects xulrunner
- CVE-2010-1199 Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before… Also affects xulrunner
- CVE-2010-0167 The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x… Also affects xulrunner
- CVE-2009-3382 layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x… Also affects xulrunner
- CVE-2009-2464 The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before… Also affects xulrunner