« Volver al listado

CVE-2009-2479

Estado: ModificadaAlta (7.8)—💥 Exploit

Firefox de Mozilla versiones 3.0.x, 3.5 y 3.5.1 en Windows, permite a los atacantes remotos causar una denegación de servicio (excepción no detectada y bloqueo de aplicación) por medio de un argumento de cadena Unicode largo en el método write. NOTA: esto se reportó originalmente como un desbordamiento de búfer en la región stack de la memoria. NOTA: en Linux y Mac OS X, un bloqueo resultante de esta cadena larga se produce en una biblioteca de sistema operativo, no en Firefox.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Mozilla — Firefox

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2479",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-07-16T15:30:00.813",
  "references": [
    {
      "url": "http://blog.mozilla.com/security/2009/07/19/milw0rm-9158-stack-overflow-crash-not-exploitable-cve-2009-2479/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/55931",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://websecurity.com.ua/3338/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/9158",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/505092/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/35707",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1022580",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=504342",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=504343",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51729",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://blog.mozilla.com/security/2009/07/19/milw0rm-9158-stack-overflow-crash-not-exploitable-cve-2009-2479/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/55931",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://websecurity.com.ua/3338/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/9158",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/505092/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/35707",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1022580",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=504342",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=504343",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51729",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox 3.0.x, 3.5, and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exception and application crash) via a long Unicode string argument to the write method. NOTE: this was originally reported as a stack-based buffer overflow. NOTE: on Linux and Mac OS X, a crash resulting from this long string reportedly occurs in an operating-system library, not in Firefox."
    },
    {
      "lang": "es",
      "value": "Firefox de Mozilla versiones 3.0.x, 3.5 y 3.5.1 en Windows, permite a los atacantes remotos causar una denegación de servicio (excepción no detectada y bloqueo de aplicación) por medio de un argumento de cadena Unicode largo en el método write. NOTA: esto se reportó originalmente como un desbordamiento de búfer en la región stack de la memoria. NOTA: en Linux y Mac OS X, un bloqueo resultante de esta cadena larga se produce en una biblioteca de sistema operativo, no en Firefox."
    }
  ],
  "lastModified": "2026-06-16T23:09:32.383",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11E07FED-ABDB-4B0A-AB2E-4CBF1EAC4301"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A6558F1-9E0D-4107-909A-8EF4BC8A9C2F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63DF3D65-C992-44CF-89B4-893526C6242E"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9024117-2E8B-4240-9E21-CC501F3879B5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBC3CAD3-2F54-4E32-A0C9-0D826C45AC23"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52624B41-AB34-40AD-8709-D9646B618AB0"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "917E9856-9556-4FD6-A834-858F8837A6B4"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98BBD74D-930C-4D80-A91B-0D61347BAA63"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAF2E696-883D-4DE5-8B79-D8E5D9470253"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94E04FD9-38E8-462D-82C2-729F7F7F0465"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5888517E-3C57-4A0A-9895-EA4BCB0A0ED5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BB21291-B9F3-445E-A9E9-EA1822083DD3"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D595F649-ECBE-45E0-8AAD-BCBC65A654B9"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FE6E920-9A4C-431B-89EA-683A22F15ACD"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18B6CC9F-6295-4598-B28B-0CA19D1D9F45"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9F0434D-C84F-49FD-9F44-66D3ACD7B601"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6AAB416-E865-4EEE-8FCB-A91253BEB52B"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76CD3BDF-A079-4EF3-ABDE-43CBDD08DB1F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "031E8624-5161-43AF-AF19-6BAB5A94FDD8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorImpact": "Reference links provided indicate Denial of Service impact only.",
  "sourceIdentifier": "cve@mitre.org"
}