CVE-2009-2044: Input Validation

Q: Which systems are affected?

The issue affects Mozilla Firefox 3.0.10 and earlier when running on Linux. The provided data does not identify other Firefox versions or operating systems as affected.

Q: What does an attacker need to do to trigger the issue?

An attacker must induce Firefox to process a URI for a large GIF image specified in the BACKGROUND attribute of a BODY element. Exploitation is remote and requires no authentication.

Q: What is the impact of successful exploitation?

Successful exploitation causes the Firefox application to crash, resulting in a denial of service. The provided data indicates no confidentiality or integrity impact.

Q: What should organizations do?

Apply the available patch. The provided data does not specify an alternative mitigation if patching cannot be performed immediately.

Published Jun 12, 2009

Updated

Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via a URI for a large GIF image in the BACKGROUND attribute of a BODY element.

Affected Software

2 affected components

Mozilla Firefox<=3.0.10

Linux Linux kernel

Remediation

Patch Available

http://www.securityfocus.com/bid/35280

Event History

Jun 12, 2009

CVE Published

via MITRE·09:07 PM

Data Sourced

via MITRE·09:07 PM

Description

Data Sourced

09:30 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which systems are affected?

The issue affects Mozilla Firefox 3.0.10 and earlier when running on Linux. The provided data does not identify other Firefox versions or operating systems as affected.

What does an attacker need to do to trigger the issue?

An attacker must induce Firefox to process a URI for a large GIF image specified in the BACKGROUND attribute of a BODY element. Exploitation is remote and requires no authentication.

What is the impact of successful exploitation?

Successful exploitation causes the Firefox application to crash, resulting in a denial of service. The provided data indicates no confidentiality or integrity impact.

What should organizations do?

Apply the available patch. The provided data does not specify an alternative mitigation if patching cannot be performed immediately.

CVE-2009-2044: Input Validation

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which systems are affected?

What does an attacker need to do to trigger the issue?

What is the impact of successful exploitation?

What should organizations do?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected?

What does an attacker need to do to trigger the issue?

What is the impact of successful exploitation?

What should organizations do?