CVE-2009-1833
published 2009-06-12CVE-2009-1833: The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of…
PriorityP335critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
9.18%
94.8th percentile
The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) js_LeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.
Affected
180 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 3.0.10 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2009-06-25·CVSS 5.0
CVE-2009-1303 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Thunderbird vulnerabilities
Several flaws were discovered in the JavaScript engine of Thunderbird. If a
user had JavaScript enabled and were tricked into viewing malicious web
content, a remote attacker could cause a denial of service or possibly
execute arbitrary code with the privileges of the user invoking the
program. (CVE-2009-1303, CVE-2009-1305, CVE-2009-1392, CVE-2009-1833,
CVE-2009-1838)
Several flaws were discovered in the way Thunderbird processed malformed
URI schemes. If a user were tricked into viewing a malicious website and
had JavaScript and plugins enabled, a remote attacker could execute
arbitrary JavaScript or steal private data. (CVE-2009-1306, CVE-2009-1307,
CVE-2009-1309)
Cefn Hoile discovered Thunderbird did not adequa
Ubuntu
Firefox and Xulrunner vulnerabilities
vendor_ubuntu·2009-06-12·CVSS 9.3
CVE-2009-1841 [CRITICAL] Firefox and Xulrunner vulnerabilities
Title: Firefox and Xulrunner vulnerabilities
Summary: Firefox and Xulrunner vulnerabilities
Several flaws were discovered in the browser and JavaScript engines of
Firefox. If a user were tricked into viewing a malicious website, a remote
attacker could cause a denial of service or possibly execute arbitrary code
with the privileges of the user invoking the program. (CVE-2009-1392,
CVE-2009-1832, CVE-2009-1833, CVE-2009-1837, CVE-2009-1838)
Pavel Cvrcek discovered that Firefox would sometimes display certain
invalid Unicode characters as whitespace. An attacker could exploit this to
spoof the location bar, such as in a phishing attack. (CVE-2009-1834)
Gregory Fleischer, Adam Barth and Collin Jackson discovered that Firefox
would allow access to local files from resources loaded via the
Red Hat
Firefox JavaScript engine crashes
vendor_redhat·2009-06-11·CVSS 9.3
CVE-2009-1833 [CRITICAL] Firefox JavaScript engine crashes
Firefox JavaScript engine crashes
The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) js_LeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.
GHSA
GHSA-3f5w-q39v-gmmh: The JavaScript engine in Mozilla Firefox before 3
ghsa_unreviewed·2022-05-02
CVE-2009-1833 [HIGH] CWE-94 GHSA-3f5w-q39v-gmmh: The JavaScript engine in Mozilla Firefox before 3
The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) js_LeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.
No detection rules found.
http://osvdb.org/55152http://osvdb.org/55153http://osvdb.org/55154http://rhn.redhat.com/errata/RHSA-2009-1096.htmlhttp://secunia.com/advisories/35331http://secunia.com/advisories/35415http://secunia.com/advisories/35428http://secunia.com/advisories/35431http://secunia.com/advisories/35439http://secunia.com/advisories/35440http://secunia.com/advisories/35468http://secunia.com/advisories/35536http://secunia.com/advisories/35561http://secunia.com/advisories/35602http://securitytracker.com/id?1022376http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1http://www.debian.org/security/2009/dsa-1820http://www.mandriva.com/security/advisories?name=MDVSA-2009:141http://www.mozilla.org/security/announce/2009/mfsa2009-24.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1125.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1126.htmlhttp://www.securityfocus.com/bid/35326http://www.securityfocus.com/bid/35372http://www.securitytracker.com/id?1022397http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275http://www.ubuntu.com/usn/usn-782-1http://www.vupen.com/english/advisories/2009/1572http://www.vupen.com/english/advisories/2009/2152https://bugzilla.mozilla.org/show_bug.cgi?id=369696https://bugzilla.mozilla.org/show_bug.cgi?id=426520https://bugzilla.mozilla.org/show_bug.cgi?id=427196https://bugzilla.mozilla.org/show_bug.cgi?id=487204https://bugzilla.redhat.com/show_bug.cgi?id=503570https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11487https://rhn.redhat.com/errata/RHSA-2009-1095.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.htmlhttp://osvdb.org/55152http://osvdb.org/55153http://osvdb.org/55154http://rhn.redhat.com/errata/RHSA-2009-1096.htmlhttp://secunia.com/advisories/35331http://secunia.com/advisories/35415http://secunia.com/advisories/35428http://secunia.com/advisories/35431http://secunia.com/advisories/35439http://secunia.com/advisories/35440http://secunia.com/advisories/35468http://secunia.com/advisories/35536http://secunia.com/advisories/35561http://secunia.com/advisories/35602http://securitytracker.com/id?1022376http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1http://www.debian.org/security/2009/dsa-1820http://www.mandriva.com/security/advisories?name=MDVSA-2009:141http://www.mozilla.org/security/announce/2009/mfsa2009-24.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1125.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1126.htmlhttp://www.securityfocus.com/bid/35326http://www.securityfocus.com/bid/35372http://www.securitytracker.com/id?1022397http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275http://www.ubuntu.com/usn/usn-782-1http://www.vupen.com/english/advisories/2009/1572http://www.vupen.com/english/advisories/2009/2152https://bugzilla.mozilla.org/show_bug.cgi?id=369696https://bugzilla.mozilla.org/show_bug.cgi?id=426520https://bugzilla.mozilla.org/show_bug.cgi?id=427196https://bugzilla.mozilla.org/show_bug.cgi?id=487204https://bugzilla.redhat.com/show_bug.cgi?id=503570https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11487https://rhn.redhat.com/errata/RHSA-2009-1095.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html
2009-06-12
Published