CVE-2009-2471: Critical severity firefox vulnerability
Published Jul 22, 2009
·Updated
The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related to XPCNativeWrapper.
Affected Software
95 affected components
Mozilla Firefox=0.1
Mozilla Firefox=0.9_rc
Mozilla Firefox=0.8
Mozilla Firefox=2.0.0.12
Mozilla Firefox=1.5-beta2
Mozilla Firefox=3.0.7
Mozilla Firefox=1.5.2
Mozilla Firefox=3.0.9
Mozilla Firefox=1.5.0.6
Mozilla Firefox=1.8
Mozilla Firefox=2.0.0.2
Mozilla Firefox=1.5.0.10
Mozilla Firefox=1.5.0.3
Mozilla Firefox=3.0.8
Mozilla Firefox=1.5.0.11
Mozilla Firefox=1.4.1
Mozilla Firefox=1.5.4
Mozilla Firefox=1.0.2
Mozilla Firefox=3.0.4
Mozilla Firefox=1.5-beta1
Mozilla Firefox=3.0.5
Mozilla Firefox=1.5
Mozilla Firefox=0.9.1
Mozilla Firefox=1.0.4
Mozilla Firefox=2.0.0.7
Mozilla Firefox=1.0.7
Mozilla Firefox=2.0.0.9
Mozilla Firefox=0.10.1
Mozilla Firefox=0.9
Mozilla Firefox=2.0.0.16
Mozilla Firefox=3.0-beta2
Mozilla Firefox=1.5.6
Mozilla Firefox=2.0.0.17
Mozilla Firefox=0.7
Mozilla Firefox=2.0.0.15
Mozilla Firefox=3.0.10
Mozilla Firefox=0.2
Mozilla Firefox=0.3
Mozilla Firefox=1.0
Mozilla Firefox=3.0.3
Mozilla Firefox<=3.0.11
Mozilla Firefox=1.5.0.7
Mozilla Firefox=2.0
Mozilla Firefox=1.0.1
Mozilla Firefox=2.0-beta1
Mozilla Firefox=2.0.0.14
Mozilla Firefox=0.6
Mozilla Firefox=0.7.1
Mozilla Firefox=3.0.6
Mozilla Firefox=1.5.0.8
Mozilla Firefox=1.0.6
Mozilla Firefox=2.0.0.3
Mozilla Firefox=1.5.0.9
Mozilla Firefox=1.5.0.5
Mozilla Firefox=1.5.7
Mozilla Firefox=1.5.0.12
Mozilla Firefox=2.0.0.6
Mozilla Firefox=3.0
Mozilla Firefox=2.0.0.11
Mozilla Firefox=1.5.0.2
Mozilla Firefox=1.0.3
Mozilla Firefox=3.0.1
Mozilla Firefox=2.0.0.4
Mozilla Firefox=0.5
Mozilla Firefox=0.6.1
Mozilla Firefox=1.5.1
Mozilla Firefox=2.0.0.21
Mozilla Firefox=0.9.3
Mozilla Firefox=2.0.0.13
Mozilla Firefox=2.0.0.18
Mozilla Firefox=2.0-rc2
Mozilla Firefox=2.0.0.1
Mozilla Firefox=3.0.2
Mozilla Firefox=1.5.5
Mozilla Firefox=0.9.2
Mozilla Firefox=1.0-preview_release
Mozilla Firefox=2.0-beta_1
Mozilla Firefox=2.0.0.20
Mozilla Firefox=2.0.0.8
Mozilla Firefox=3.0-beta5
Mozilla Firefox=0.9-rc
Mozilla Firefox=2.0.0.19
Mozilla Firefox=1.5.8
Mozilla Firefox=1.5.3
Mozilla Firefox=0.4
Mozilla Firefox=1.5.0.4
Mozilla Firefox=1.5.0.1
Mozilla Firefox=0.10
Mozilla Firefox=1.0.5
Mozilla Firefox=2.0.0.5
Mozilla Firefox=2.0.0.10
Mozilla Firefox=2.0-rc3
Mozilla Firefox=3.0-alpha
Mozilla Firefox=1.0.6
Mozilla Firefox=1.0.8
Remediation
Patch Available
Patch Available
Patch Available
Event History
Jul 22, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2471?
CVE-2009-2471 has a medium severity rating, allowing for arbitrary JavaScript execution with chrome privileges.
2
How do I fix CVE-2009-2471?
The issue can be fixed by upgrading to Mozilla Firefox version 3.0.12 or later.
3
What versions of Firefox are affected by CVE-2009-2471?
CVE-2009-2471 affects various versions of Firefox including all versions prior to 3.0.12.
4
What impact does CVE-2009-2471 have on security?
CVE-2009-2471 allows remote attackers to execute arbitrary JavaScript, potentially compromising browser security.
5
Is CVE-2009-2471 related to object wrapping in Firefox?
Yes, CVE-2009-2471 is specifically related to the improper preservation of object wrapping in the setTimeout function.