CVE-2009-2479

EPSS 12.1%

Mozilla Firefox 3.0.x, 3.5, and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exception and application crash) via a long Unicode string argument to the write method. NOTE: this was originally reported as a stack-based buffer overflow. NOTE: on Linux and Mac OS X, a crash resulting from this long string reportedly occurs in an operating-system library, not in Firefox.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/9158unverified exploitdbwww.exploit-db.com/exploits/9158unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://blog.mozilla.com/security/2009/07/19/milw0rm-9158-stack-overflow-crash-not-exploitable-cve-2009-2479/http://osvdb.org/55931 https://bugzilla.mozilla.org/show_bug.cgi?id=504342 https://bugzilla.mozilla.org/show_bug.cgi?id=504343 https://exchange.xforce.ibmcloud.com/vulnerabilities/51729 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html http://websecurity.com.ua/3338/http://www.exploit-db.com/exploits/9158 http://www.securityfocus.com/archive/1/505092/100/0/threaded http://www.securityfocus.com/bid/35707 http://www.securitytracker.com/id?1022580