CVE-2009-1833: Code Injection
Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
Jesse Ruderman, Adam Hauner, and Igor Bukanov reported crashes in the Firefox 3 JavaScript engine.
Other sources
The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) jsLeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1833?
CVE-2009-1833 is classified as a medium severity vulnerability due to evidence of memory corruption that could lead to crashes.
How do I fix CVE-2009-1833?
To fix CVE-2009-1833, update affected Mozilla products such as Firefox, SeaMonkey, or Thunderbird to the latest version available.
What versions are affected by CVE-2009-1833?
Affected versions of Mozilla products include various releases of Firefox, Thunderbird, and SeaMonkey, specifically older versions leading up to 3.0.10.
Can CVE-2009-1833 be exploited remotely?
Yes, CVE-2009-1833 can potentially be exploited remotely to cause denial of service through crafted web content.
What are the implications of CVE-2009-1833 on user data?
While CVE-2009-1833 primarily leads to application crashes, it may indirectly pose risks to user data depending on the context of exploit.