Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-2953 — Mozilla Firefox vulnerability

5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
2.6%
top 14.37%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Mozilla Firefox
Timeline
PublishedAug 24
Latest updateMay 2

Description

Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote attackers to cause a denial of service (CPU consumption) via JavaScript code with a long string value for the hash property (aka location.hash), a related issue to CVE-2008-5715.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDmozilla/firefox13 versions+12

🔴Vulnerability Details

1
GHSA
GHSA-7wrp-3pc5-gg9v: Mozilla Firefox 3↗2022-05-02
▶

💥Exploits & PoCs

1
Exploit-DB
Mozilla Firefox 3.0.5 - location.hash Remote Crash↗2008-12-23
▶

📋Vendor Advisories

1
Red Hat
firefox: CPU consumption via malicious javascript↗2009-08-21
▶

💬Community

1
Bugzilla
CVE-2009-2953 firefox: CPU consumption via malicious javascript↗2009-08-24
▶