CVE-2009-2414

mingw32-libxml2: Stack overflow by parsing root XML element DTD definition

Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.

CVSS 2.0 · 4.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Redhat Xmlsoft

Products

Enterprise Linux Libxml Libxml2

CVE-2009-2408

firefox/nss: doesn't handle NULL in Common Name properly

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

CVSS 3.1 · 5.9 Medium EPSS 5.7% KEV · Not listed

Vendors

Canonical Debian Mozilla and 3 more

Products

Ubuntu Linux Debian Linux Firefox and 8 more

CVE-2009-2409

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

CVSS 2.0 · 5.1 Medium EPSS 4.3% KEV · Not listed

Vendors

Gnu Mozilla Openssl and 1 more

Products

Gnutls Network Security Services Openssl and 4 more

CVE-2009-2411

subversion: multiple heap overflow issues

Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412.

CVSS 2.0 · 8.5 High EPSS 5.1% KEV · Not listed

Vendors

Redhat Subversion

Products

Enterprise Linux Subversion

CVE-2009-2412

apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 10.0 Critical EPSS 13.8% KEV · Not listed

Vendors

Apache Redhat

Products

Apr-util Portable Runtime Certificate System and 2 more

CVE-2009-2416

mingw32-libxml2: Pointer use-after-free flaws by parsing Notation and Enumeration attribute types

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed

Vendors

Apple Canonical Debian and 8 more

Products

Iphone Os Mac Os X Mac Os X Server and 16 more

CVE-2009-2417

curl: incorrect verification of SSL certificate with NUL in name

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS 2.0 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Curl Libcurl Redhat

Products

Libcurl Libcurl Enterprise Linux

CVE-2009-2446

MySQL: Format string vulnerability by manipulation with database instances (crash)

Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 8.5 High EPSS 10.6% KEV · Not listed

Vendors

Mysql Oracle Redhat

Products

Mysql Mysql Enterprise Linux

CVE-2009-2462

Mozilla Browser engine crashes

The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux

CVE-2009-2463

Mozilla Base64 decoding crash

Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.

CVSS 2.0 · 10.0 Critical EPSS 6.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux

CVE-2009-2464

Mozilla crash with multiple RDFs in XUL tree

The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to loading multiple RDF files in a XUL tree element.

CVSS 2.0 · 10.0 Critical EPSS 13.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Seamonkey Thunderbird and 1 more

CVE-2009-2465

Mozilla double frame construction crashes

Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via vectors involving double frame construction, related to (1) nsHTMLContentSink.cpp, (2) nsXMLContentSink.cpp, and (3) nsPresShell.cpp, and the nsSubDocumentFrame::Reflow function.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux

CVE-2009-2467

Mozilla remote code execution during Flash player unloading

Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a Flash object, a slow script dialog, and the unloading of the Flash plugin, which triggers attempted use of a deleted object.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux

CVE-2009-2469

Mozilla remote code execution using watch and __defineSetter__ on SVG element

Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an __defineSetter__ function, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted document, related to a certain pointer misinterpretation.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux

CVE-2009-2470

Mozilla data corruption with SOCKS5 reply

Mozilla Firefox before 3.0.12, and 3.5.x before 3.5.2, allows remote SOCKS5 proxy servers to cause a denial of service (data stream corruption) via a long domain name in a reply.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux

CVE-2009-2471

Mozilla setTimeout loses XPCNativeWrappers

The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related to XPCNativeWrapper.

CVSS 2.0 · 10.0 Critical EPSS 3.7% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux

CVE-2009-2472

Mozilla multiple cross origin wrapper bypasses

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Fedoraproject Mozilla Opensuse and 2 more

Products

Fedora Firefox Opensuse and 4 more

CVE-2009-2473

neon: billion laughs DoS attack

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVSS 2.0 · 4.3 Medium EPSS 8.4% KEV · Not listed

Vendors

Redhat Webdav

Products

Enterprise Linux Neon

CVE-2009-2474

neon: Improper verification of x509v3 certificate with NULL (zero) byte in certain fields

neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS 2.0 · 5.8 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Canonical Fedoraproject and 2 more

Products

Mac Os X Ubuntu Linux Fedora and 2 more

CVE-2009-2475

OpenJDK information leaks in mutable variables (6588003,6656586,6656610,6656625,6657133,6657619,6657625,6657695,6660049,6660539,6813167)

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.

CVSS 2.0 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Network Satellite Rhel Extras and 2 more