CVE-2009-1837: Race Condition
Jakob Balle and Carsten Eiram of Secunia Research reported a race condition in NPObjWrapperNewResolve when accessing the properties of a NPObject, a wrapped JSObject. Balle and Eiram demonstrated that this condition could be reached by navigating away from a web page during the loading of a Java applet. Under such conditions the Java object would be destroyed but later called into resulting in a free memory read. An attacker could potentially write to the freed memory before it is reused and run arbitrary code on the victim's computer.
Other sources
Race condition in the NPObjWrapperNewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free vulnerability for memory associated with a destroyed Java object.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1837?
CVE-2009-1837 has a moderate severity rating due to the potential for a race condition leading to potential exploitation.
How do I fix CVE-2009-1837?
To fix CVE-2009-1837, update your Mozilla Firefox to versions 3.0.10 or later.
What versions of Firefox are affected by CVE-2009-1837?
CVE-2009-1837 affects Mozilla Firefox versions 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, and beta versions before 3.0.11.
What is the impact of CVE-2009-1837?
The impact of CVE-2009-1837 may allow attackers to execute arbitrary code by triggering a race condition when accessing the properties of a NPObject.
Who discovered CVE-2009-1837?
CVE-2009-1837 was discovered by Jakob Balle and Carsten Eiram of Secunia Research.