NVD

Id
48012  
Name
CVE-2009-0689  
Description
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-07-01  
Modified Date
2014-03-25  
Seq
2009-0689  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
240789 48012 CVE-2009-0689 http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h  View
240790 48012 CVE-2009-0689 APPLE-SA-2010-03-29-1  View
240791 48012 CVE-2009-0689 APPLE-SA-2010-06-21-1  View
240792 48012 CVE-2009-0689 SUSE-SR:2009:018  View
240793 48012 CVE-2009-0689 SUSE-SR:2010:013  View
240794 48012 CVE-2009-0689 oval:org.mitre.oval:def:6528  View
240795 48012 CVE-2009-0689 oval:org.mitre.oval:def:9541  View
240796 48012 CVE-2009-0689 RHSA-2014:0311  View
240797 48012 CVE-2009-0689 RHSA-2014:0312  View
240798 48012 CVE-2009-0689 20090625 Multiple Vendors libc/gdtoa printf(3) Array Overrun  View
240799 48012 CVE-2009-0689 20091030 Multiple BSD printf(1) and multiple dtoa/*printf(3) vulnerabilities  View
240800 48012 CVE-2009-0689 20091120 SeaMonkey 1.1.8 Remote Array Overrun (Arbitrary code execution)  View
240801 48012 CVE-2009-0689 20091120 K-Meleon 1.5.3 Remote Array Overrun (Arbitrary code execution)  View
240802 48012 CVE-2009-0689 20091120 Opera 10.01 Remote Array Overrun (Arbitrary code execution)  View
240803 48012 CVE-2009-0689 20091211 Flock 2.5.2 Remote Array Overrun (Arbitrary code execution)  View
240804 48012 CVE-2009-0689 20091211 Camino 1.6.10 Remote Array Overrun (Arbitrary code execution)  View
240805 48012 CVE-2009-0689 20091211 Sunbird 0.9 Array Overrun (code execution)  View
240806 48012 CVE-2009-0689 20091211 Thunderbird 2.0.0.23 (lib) Remote Array Overrun (Arbitrary code execution)  View
240807 48012 CVE-2009-0689 20100108 MacOS X 10.5/10.6 libc/strtod(3) buffer overflow  View
240808 48012 CVE-2009-0689 1022478  View
240809 48012 CVE-2009-0689 272909  View
240810 48012 CVE-2009-0689 http://support.apple.com/kb/HT4077  View
240811 48012 CVE-2009-0689 http://support.apple.com/kb/HT4225  View
240812 48012 CVE-2009-0689 MDVSA-2009:294  View
240813 48012 CVE-2009-0689 MDVSA-2009:330  View
240814 48012 CVE-2009-0689 http://www.mozilla.org/security/announce/2009/mfsa2009-59.html  View
240815 48012 CVE-2009-0689 http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/misc.c  View
240816 48012 CVE-2009-0689 http://www.opera.com/support/kb/view/942/  View
240817 48012 CVE-2009-0689 RHSA-2009:1601  View
240818 48012 CVE-2009-0689 RHSA-2010:0153  View
240819 48012 CVE-2009-0689 RHSA-2010:0154  View
240820 48012 CVE-2009-0689 20091120 K-Meleon 1.5.3 Remote Array Overrun (Arbitrary code execution)  View
240821 48012 CVE-2009-0689 20091120 SeaMonkey 1.1.8 Remote Array Overrun (Arbitrary code execution)  View
240822 48012 CVE-2009-0689 20091210 Flock 2.5.2 Remote Array Overrun (Arbitrary code execution)  View
240823 48012 CVE-2009-0689 20091210 Camino 1.6.10 Remote Array Overrun (Arbitrary code execution)  View
240824 48012 CVE-2009-0689 35510  View
240825 48012 CVE-2009-0689 USN-915-1  View
240826 48012 CVE-2009-0689 ADV-2009-3297  View
240827 48012 CVE-2009-0689 ADV-2009-3299  View
240828 48012 CVE-2009-0689 ADV-2009-3334  View
240829 48012 CVE-2009-0689 ADV-2010-0094  View
240830 48012 CVE-2009-0689 ADV-2010-0648  View
240831 48012 CVE-2009-0689 ADV-2010-0650  View
240832 48012 CVE-2009-0689 https://bugzilla.mozilla.org/show_bug.cgi?id=516396  View
240833 48012 CVE-2009-0689 https://bugzilla.mozilla.org/show_bug.cgi?id=516862  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41402 JVNDB-2009-002409 libc における任意のコードを実行される脆弱性 libc の dtoa.c または gdtoa/misc.c には、浮動小数点を変換する処理に不備があるため、任意のコードを実行される、およびサービス運用妨害 (DoS) 状態にされる脆弱性が存在します。 CVE-2009-0689 38120 CVE-2009-0689 48012 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002409.html 2009-07-01 2010-07-13 View