New Search

Mozilla Firefox Floating Point Memory Allocation Vulnerability

oval:org.mitre.oval:def:6528

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2 NetBSD 5.0 OpenBSD 4.5 Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4 K-Meleon 1.5.3 SeaMonkey 1.1.8 and other products allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

Family:
windows
Status:
ACCEPTED
Platform(s):
  • Microsoft Windows 2000
  • Microsoft Windows Server 2003
  • Microsoft Windows Vista
  • Microsoft Windows 7
  • Microsoft Windows XP
Class:
vulnerability
Reference(s):
  • CVE-2009-0689
Product(s):
  • Mozilla Firefox