CVE-2009-3382: Critical severity firefox vulnerability

Published Oct 29, 2009

Updated

layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 does not properly handle first-letter frames, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.

Affected Software

14 affected components

Mozilla Firefox=3.0.7

Mozilla Firefox=3.0.9

Mozilla Firefox=3.0.8

Mozilla Firefox=3.0.4

Mozilla Firefox=3.0.5

Mozilla Firefox=3.0.14

Mozilla Firefox=3.0.10

Mozilla Firefox=3.0.12

Mozilla Firefox=3.0.3

Mozilla Firefox=3.0.6

Mozilla Firefox=3.0.1

Mozilla Firefox=3.0.2

Mozilla Firefox=3.0.13

Mozilla Firefox=3.0.11

Remediation

Patch Available

http://www.mozilla.org/security/announce/2009/mfsa2009-64.html

Event History

Oct 29, 2009

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-3382?

CVE-2009-3382 is classified as a security vulnerability that can lead to denial of service and possibly arbitrary code execution.

How do I fix CVE-2009-3382?

To fix CVE-2009-3382, upgrade your Mozilla Firefox to version 3.0.15 or later.

Which versions of Firefox are affected by CVE-2009-3382?

CVE-2009-3382 affects Mozilla Firefox versions 3.0.1 through 3.0.14.

What type of vulnerability is CVE-2009-3382?

CVE-2009-3382 is a memory corruption vulnerability that affects the rendering of first-letter frames in Firefox.

Can CVE-2009-3382 be exploited remotely?

Yes, CVE-2009-3382 can be exploited remotely, potentially allowing attackers to crash the browser or execute arbitrary code.