CVE-2009-2477

Status: ModifiedHigh (9.3)—💥 Exploit

js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.

CVSS

Version: 2.0
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Base score: 9.3

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 43%
Percentile among all scored CVEs: 99
Score date: 10/14/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Metasploit module (reliable, widely available exploit) · Firefox 3.5 escape() Return Value Memory Corruption
Published on Exploit-DB · Naenara Browser 3.5 (RedStar 3.0 Desktop) - 'JACKRABBIT' Client-Side Command Execution (12/18/2016)
Published on Exploit-DB · Mozilla Firefox 3.5 - 'escape()' Return Value Memory Corruption (Metasploit) (9/20/2010)
Published on Exploit-DB · Mozilla Firefox 3.5 - 'Font tags' Remote HeapSpray (2) (7/20/2009)
Published on Exploit-DB · Mozilla Firefox 3.5 - Font tags Remote Buffer Overflow (7/13/2009)

Affected technologies (1)

Mozilla — Firefox

CWEs

CWE-94

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2009-2477",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-07-15T15:30:01.453",
  "references": [
    {
      "url": "http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://isc.sans.org/diary.html?storyid=6796",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35798",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/9137",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/9181",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/443060",
      "tags": [
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-41.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/35660",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/1868",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=503286",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40936/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://isc.sans.org/diary.html?storyid=6796",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35798",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/9137",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.exploit-db.com/exploits/9181",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/443060",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-41.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/35660",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/1868",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=503286",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40936/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements."
    },
    {
      "lang": "es",
      "value": "El archivo js/src/jstracer.cpp en el compilador JavaScript Just-in-Time (JIT) (también se conoce como TraceMonkey) en Firefox de Mozilla versiones 3.5 anteriores a 3.5.1, permite a los atacantes remotos ejecutar código arbitrario por medio de cierto uso de la función escape que desencadena el acceso a ubicaciones de memoria no inicializadas, como es demostrado originalmente por un documento que contiene elementos P y FONT."
    }
  ],
  "lastModified": "2026-06-16T23:09:32.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76CD3BDF-A079-4EF3-ABDE-43CBDD08DB1F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}