Strix
26.1K

CVE-2009-1392

UnknownEPSS 9.28%

Last modified

CVE-2009-1392 is a vulnerability of currently unknown severity. The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsEventStateManager::GetContentState and nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames and ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, related to the atom table, DOM mutation events, and Unicode surrogates; (8) nsHTMLEditor::HideResizers; and (9) nsWindow::SetCursor, related to changing the cursor; and other vectors.. EPSS estimates a 9.28% chance of exploitation in the next 30 days.

Description

The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsEventStateManager::GetContentState and nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames and ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, related to the atom table, DOM mutation events, and Unicode surrogates; (8) nsHTMLEditor::HideResizers; and (9) nsWindow::SetCursor, related to changing the cursor; and other vectors.

Metrics

EPSS Probability
9.28%

94.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
MozillaFirefox3.0
MozillaFirefox3.0.1
MozillaFirefox3.0.2
MozillaFirefox3.0.3
MozillaFirefox3.0.4
MozillaFirefox3.0.5
MozillaFirefox3.0.6
MozillaFirefox3.0.7
MozillaFirefox3.0.8
MozillaFirefox3.0.9
MozillaFirefox3.0.10
MozillaSeamonkey<= 1.1.16
MozillaSeamonkey1.0
MozillaSeamonkey1.0.1
MozillaSeamonkey1.0.3
MozillaSeamonkey1.0.4
MozillaSeamonkey1.0.6
MozillaSeamonkey1.0.8
MozillaSeamonkey1.0.9
MozillaSeamonkey1.0.99
MozillaSeamonkey1.1
MozillaSeamonkey1.1.1
MozillaSeamonkey1.1.3
MozillaSeamonkey1.1.5
MozillaSeamonkey1.1.6
MozillaSeamonkey1.1.7
MozillaSeamonkey1.1.8
MozillaSeamonkey1.1.9
MozillaSeamonkey1.1.10
MozillaSeamonkey1.1.11
MozillaSeamonkey1.1.12
MozillaSeamonkey1.1.13
MozillaSeamonkey1.1.15
MozillaThunderbird<= 2.0.0.19
MozillaThunderbird0.1
MozillaThunderbird0.2
MozillaThunderbird0.3
MozillaThunderbird0.4
MozillaThunderbird0.5
MozillaThunderbird0.6
MozillaThunderbird0.7
MozillaThunderbird0.7.1
MozillaThunderbird0.7.2
MozillaThunderbird0.7.3
MozillaThunderbird0.8
MozillaThunderbird0.9
MozillaThunderbird1.0
MozillaThunderbird1.0.1
MozillaThunderbird1.0.2
MozillaThunderbird1.0.3

Showing 50 of 100 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2009-1392?
The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsEventStateManager::GetContentState and nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames and ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, related to the atom table, DOM mutation events, and Unicode surrogates; (8) nsHTMLEditor::HideResizers; and (9) nsWindow::SetCursor, related to changing the cursor; and other vectors.
How severe is CVE-2009-1392?
Severity scoring for CVE-2009-1392 is pending analysis. The EPSS model estimates a 9.28% probability of exploitation in the next 30 days.
How do I fix CVE-2009-1392?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-1392?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST