RCE in Mozilla Firefox

CVE-2009-1571

Use-after-free vulnerability in the HTML parser in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to execute arbitrary code via unspecified method calls that attempt to access freed objects in low-memory situations.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.064 (92.9th percentile) — read the EPSS interpretation.

Affected products

Mozilla Firefox — versions 3.5, 3.0.6, 3.0.13
Mozilla Seamonkey — versions 1.0.9, 1.1.1, 1.1.12
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

PSIRT-CNA@flexerasoftware.com (x_refsource_FEDORA, vendor-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_FEDORA, vendor-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_FEDORA, vendor-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_FEDORA, vendor-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_FEDORA, vendor-advisory)
PSIRT-CNA@flexerasoftware.com (vendor-advisory, x_refsource_SUSE)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, third-party-advisory)