CVE-2009-0689

K-Meleon 1.5.3 - Remote Array Overrun

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

Error de índice de matriz en la (1) implementación dtoa en archivo dtoa.c (también se conoce como pdtoa.c) y (2) la implementación gdtoa (también se conoce como dtoa new dtoa) en archivo gdtoa/misc.c en libc, tal y como es usado en múltiples sistemas operativos y productos, incluidos FreeBSD versiones 6.4 y 7.2, Net versión 5.0, OpenBSD versión 4.5, Mozilla Firefox versión 3.0.x y anteriores a las versión 3.0.15 y 3.5.x anterior a versión 3.5.4, K-Meleon versión 1.5.3, SeaMonkey versión 1.1.8 y otros productos, permite a los atacantes dependiendo del contexto causar una denegación de servicio (bloqueo de aplicación) y posiblemente ejecutar código arbitrario por medio de un valor de precisión largo en el argumento de formato para una función printf, que desencadena una asignación de memoria inapropiada y un desbordamiento de búfer en la región heap de la memoria durante la conversión a un número de punto flotante.

KDE KDELibs version 4.3.3 suffers from a remote array overrun vulnerability that allows for arbitrary code execution.

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-02-22 CVE Reserved
2009-05-26 First Exploit
2009-06-26 CVE Published
2023-10-04 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (66)

URL	Tag	Source
http://securityreason.com/achievement_securityalert/69	Third Party Advisory
http://securityreason.com/achievement_securityalert/71	Third Party Advisory
http://securityreason.com/achievement_securityalert/72	Third Party Advisory
http://securityreason.com/achievement_securityalert/73	Third Party Advisory
http://securityreason.com/achievement_securityalert/75	Third Party Advisory
http://securityreason.com/achievement_securityalert/76	Third Party Advisory
http://securityreason.com/achievement_securityalert/77	Third Party Advisory
http://securityreason.com/achievement_securityalert/78	Third Party Advisory
http://securityreason.com/achievement_securityalert/81	Third Party Advisory
http://support.apple.com/kb/HT4077	X_refsource_confirm
http://support.apple.com/kb/HT4225	X_refsource_confirm
http://www.opera.com/support/kb/view/942	X_refsource_confirm
http://www.securityfocus.com/archive/1/507977/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/507979/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/508417/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/508423/100/0/threaded	Mailing List
https://bugzilla.mozilla.org/show_bug.cgi?id=516396	X_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=516862	X_refsource_confirm
https://lists.debian.org/debian-lts-announce/2018/11/msg00001.html	Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6528	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9541	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/10186	2009-11-19
https://www.exploit-db.com/exploits/10187	2009-11-19
https://www.exploit-db.com/exploits/10185	2009-11-19
https://www.exploit-db.com/exploits/10184	2009-11-19
https://www.exploit-db.com/exploits/33480	2010-01-08
https://www.exploit-db.com/exploits/33312	2009-10-27
https://www.exploit-db.com/exploits/33364	2009-11-20
https://www.exploit-db.com/exploits/33058	2009-05-26
https://www.exploit-db.com/exploits/33363	2009-11-20
https://www.exploit-db.com/exploits/33479	2010-01-08
https://www.exploit-db.com/exploits/10380	2009-12-11
http://securityreason.com/achievement_securityalert/63	2024-08-07
http://www.securityfocus.com/bid/35510	2024-08-07

URL	Date	SRC
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h	2018-11-02
http://securitytracker.com/id?1022478	2018-11-02
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/misc.c	2018-11-02

URL	Date	SRC
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	2018-11-02
http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html	2018-11-02
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html	2018-11-02
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html	2018-11-02
http://rhn.redhat.com/errata/RHSA-2014-0311.html	2018-11-02
http://rhn.redhat.com/errata/RHSA-2014-0312.html	2018-11-02
http://secunia.com/advisories/37431	2018-11-02
http://secunia.com/advisories/37682	2018-11-02
http://secunia.com/advisories/37683	2018-11-02
http://secunia.com/advisories/38066	2018-11-02
http://secunia.com/advisories/38977	2018-11-02
http://secunia.com/advisories/39001	2018-11-02
http://secunia.com/secunia_research/2009-35	2018-11-02
http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1	2018-11-02
http://www.mandriva.com/security/advisories?name=MDVSA-2009:294	2018-11-02
http://www.mandriva.com/security/advisories?name=MDVSA-2009:330	2018-11-02
http://www.mozilla.org/security/announce/2009/mfsa2009-59.html	2018-11-02
http://www.redhat.com/support/errata/RHSA-2009-1601.html	2018-11-02
http://www.redhat.com/support/errata/RHSA-2010-0153.html	2018-11-02
http://www.redhat.com/support/errata/RHSA-2010-0154.html	2018-11-02
http://www.ubuntu.com/usn/USN-915-1	2018-11-02
http://www.vupen.com/english/advisories/2009/3297	2018-11-02
http://www.vupen.com/english/advisories/2009/3299	2018-11-02
http://www.vupen.com/english/advisories/2009/3334	2018-11-02
http://www.vupen.com/english/advisories/2010/0094	2018-11-02
http://www.vupen.com/english/advisories/2010/0648	2018-11-02
http://www.vupen.com/english/advisories/2010/0650	2018-11-02
https://access.redhat.com/security/cve/CVE-2009-0689	2014-03-18
https://bugzilla.redhat.com/show_bug.cgi?id=539784	2014-03-18

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
K-meleon Project Search vendor "K-meleon Project"		K-meleon Search vendor "K-meleon Project" for product "K-meleon"				1.5.3 Search vendor "K-meleon Project" for product "K-meleon" and version "1.5.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.1 Search vendor "Mozilla" for product "Firefox" and version "3.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.2 Search vendor "Mozilla" for product "Firefox" and version "3.0.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.3 Search vendor "Mozilla" for product "Firefox" and version "3.0.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.4 Search vendor "Mozilla" for product "Firefox" and version "3.0.4"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.5 Search vendor "Mozilla" for product "Firefox" and version "3.0.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.6 Search vendor "Mozilla" for product "Firefox" and version "3.0.6"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.7 Search vendor "Mozilla" for product "Firefox" and version "3.0.7"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.8 Search vendor "Mozilla" for product "Firefox" and version "3.0.8"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.9 Search vendor "Mozilla" for product "Firefox" and version "3.0.9"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.10 Search vendor "Mozilla" for product "Firefox" and version "3.0.10"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.11 Search vendor "Mozilla" for product "Firefox" and version "3.0.11"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.12 Search vendor "Mozilla" for product "Firefox" and version "3.0.12"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.13 Search vendor "Mozilla" for product "Firefox" and version "3.0.13"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.14 Search vendor "Mozilla" for product "Firefox" and version "3.0.14"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5 Search vendor "Mozilla" for product "Firefox" and version "3.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.1 Search vendor "Mozilla" for product "Firefox" and version "3.5.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.2 Search vendor "Mozilla" for product "Firefox" and version "3.5.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.3 Search vendor "Mozilla" for product "Firefox" and version "3.5.3"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.8 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.8"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.4 Search vendor "Freebsd" for product "Freebsd" and version "6.4"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.4 Search vendor "Freebsd" for product "Freebsd" and version "6.4"		release		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.4 Search vendor "Freebsd" for product "Freebsd" and version "6.4"		release_p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.4 Search vendor "Freebsd" for product "Freebsd" and version "6.4"		release_p3		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.4 Search vendor "Freebsd" for product "Freebsd" and version "6.4"		release_p4		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.4 Search vendor "Freebsd" for product "Freebsd" and version "6.4"		release_p5		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				6.4 Search vendor "Freebsd" for product "Freebsd" and version "6.4"		stable		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				7.2 Search vendor "Freebsd" for product "Freebsd" and version "7.2"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				7.2 Search vendor "Freebsd" for product "Freebsd" and version "7.2"		pre-release		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				7.2 Search vendor "Freebsd" for product "Freebsd" and version "7.2"		stable		Affected
Netbsd Search vendor "Netbsd"		Netbsd Search vendor "Netbsd" for product "Netbsd"				5.0 Search vendor "Netbsd" for product "Netbsd" and version "5.0"		-		Affected
Openbsd Search vendor "Openbsd"		Openbsd Search vendor "Openbsd" for product "Openbsd"				4.5 Search vendor "Openbsd" for product "Openbsd" and version "4.5"		-		Affected