certfr_alerte - CERTA-2009-ALE-012

CERTA-2009-ALE-012

Vulnerability from certfr_alerte - Published: - Updated:

Une vulnérabilité affectant le traitement d'une balise HTML permet à une personne malveillante d'exécuter du code arbitraire à distance.

Description

Une vulnérabilité affectant le traitement de la balise \<font> par l'interpréteur JavaScript permet à une personne malveillante d'exécuter du code arbitraire à distance au moyen d'une page web spécialement écrite.

Un code permettant l'exploitation de cette vulnérabilité est disponible sur l'Internet.

Contournement provisoire

Dans l'attente d'un correctif le CERTA recommande d'utiliser un navigateur alternatif ou de naviguer avec le JavaScript désactivé.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Mozilla Firefox 3.5.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

CVE-2009-2477 (GCVE-0-2009-2477)

Vulnerability from cvelistv5 – Published: 2009-07-15 15:00 – Updated: 2024-08-07 05:52

Summary

js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://bugzilla.mozilla.org/show_bug.cgi?id=503286	x_refsource_CONFIRM
	http://www.kb.cert.org/vuls/id/443060	third-party-advisoryx_refsource_CERT-VN
	https://www.redhat.com/archives/fedora-package-an…	vendor-advisoryx_refsource_FEDORA
	https://www.exploit-db.com/exploits/40936/	exploitx_refsource_EXPLOIT-DB
	http://voices.washingtonpost.com/securityfix/2009…	x_refsource_MISC
	http://isc.sans.org/diary.html?storyid=6796	x_refsource_MISC
	http://sunsolve.sun.com/search/document.do?assetk…	vendor-advisoryx_refsource_SUNALERT
	http://www.securityfocus.com/bid/35660	vdb-entryx_refsource_BID
	http://www.exploit-db.com/exploits/9181	exploitx_refsource_EXPLOIT-DB
	http://secunia.com/advisories/35798	third-party-advisoryx_refsource_SECUNIA
	http://blog.mozilla.com/security/2009/07/14/criti…	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2009/1868	vdb-entryx_refsource_VUPEN
	http://www.exploit-db.com/exploits/9137	exploitx_refsource_EXPLOIT-DB
	http://www.h-online.com/security/First-Zero-Day-E…	x_refsource_MISC
	http://www.mozilla.org/security/announce/2009/mfs…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:52:14.977Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=503286"
          },
          {
            "name": "VU#443060",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/443060"
          },
          {
            "name": "FEDORA-2009-7898",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html"
          },
          {
            "name": "40936",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/40936/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://isc.sans.org/diary.html?storyid=6796"
          },
          {
            "name": "266148",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1"
          },
          {
            "name": "35660",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35660"
          },
          {
            "name": "9181",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/9181"
          },
          {
            "name": "35798",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35798"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/"
          },
          {
            "name": "ADV-2009-1868",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1868"
          },
          {
            "name": "9137",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/9137"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-41.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=503286"
        },
        {
          "name": "VU#443060",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/443060"
        },
        {
          "name": "FEDORA-2009-7898",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html"
        },
        {
          "name": "40936",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/40936/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://isc.sans.org/diary.html?storyid=6796"
        },
        {
          "name": "266148",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1"
        },
        {
          "name": "35660",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35660"
        },
        {
          "name": "9181",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/9181"
        },
        {
          "name": "35798",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35798"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/"
        },
        {
          "name": "ADV-2009-1868",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1868"
        },
        {
          "name": "9137",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/9137"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-41.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2477",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=503286",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=503286"
            },
            {
              "name": "VU#443060",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/443060"
            },
            {
              "name": "FEDORA-2009-7898",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html"
            },
            {
              "name": "40936",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/40936/"
            },
            {
              "name": "http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html",
              "refsource": "MISC",
              "url": "http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html"
            },
            {
              "name": "http://isc.sans.org/diary.html?storyid=6796",
              "refsource": "MISC",
              "url": "http://isc.sans.org/diary.html?storyid=6796"
            },
            {
              "name": "266148",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1"
            },
            {
              "name": "35660",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/35660"
            },
            {
              "name": "9181",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/9181"
            },
            {
              "name": "35798",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35798"
            },
            {
              "name": "http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/",
              "refsource": "CONFIRM",
              "url": "http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/"
            },
            {
              "name": "ADV-2009-1868",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1868"
            },
            {
              "name": "9137",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/9137"
            },
            {
              "name": "http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761",
              "refsource": "MISC",
              "url": "http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2009/mfsa2009-41.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-41.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2477",
    "datePublished": "2009-07-15T15:00:00",
    "dateReserved": "2009-07-15T00:00:00",
    "dateUpdated": "2024-08-07T05:52:14.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted