FKIE_CVE-2009-1044

Vulnerability from fkie_nvd - Published: 2009-03-23 14:19 - Updated: 2026-06-16 23:06
Severity
Summary
Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
References
cve@mitre.orghttp://blogs.zdnet.com/security/?p=2934
cve@mitre.orghttp://blogs.zdnet.com/security/?p=2941
cve@mitre.orghttp://cansecwest.com/index.html
cve@mitre.orghttp://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009
cve@mitre.orghttp://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html
cve@mitre.orghttp://news.cnet.com/8301-1009_3-10199652-83.html
cve@mitre.orghttp://osvdb.org/52896
cve@mitre.orghttp://secunia.com/advisories/34471Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34505Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34510Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34511Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34521Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34527Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34549Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34550Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34792Vendor Advisory
cve@mitre.orghttp://support.avaya.com/elmodocs2/security/ASA-2009-113.htm
cve@mitre.orghttp://twitter.com/tippingpoint1/status/1351635812
cve@mitre.orghttp://www.debian.org/security/2009/dsa-1756
cve@mitre.orghttp://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:084
cve@mitre.orghttp://www.mozilla.org/security/announce/2009/mfsa2009-13.htmlPatch, Vendor Advisory
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2009-0397.html
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2009-0398.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/502303/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/34181Patch
cve@mitre.orghttp://www.securitytracker.com/id?1021878
cve@mitre.orghttp://www.ubuntu.com/usn/usn-745-1
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/0864Patch, Vendor Advisory
cve@mitre.orghttp://www.zerodayinitiative.com/advisories/ZDI-09-015
cve@mitre.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=484320Patch
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11368
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2009-March/msg01023.html
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2009-March/msg01040.html
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html
af854a3a-2127-422b-91ae-364da2661108http://blogs.zdnet.com/security/?p=2934
af854a3a-2127-422b-91ae-364da2661108http://blogs.zdnet.com/security/?p=2941
af854a3a-2127-422b-91ae-364da2661108http://cansecwest.com/index.html
af854a3a-2127-422b-91ae-364da2661108http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009
af854a3a-2127-422b-91ae-364da2661108http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html
af854a3a-2127-422b-91ae-364da2661108http://news.cnet.com/8301-1009_3-10199652-83.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/52896
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34471Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34505Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34510Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34511Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34521Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34527Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34549Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34550Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34792Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm
af854a3a-2127-422b-91ae-364da2661108http://twitter.com/tippingpoint1/status/1351635812
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1756
af854a3a-2127-422b-91ae-364da2661108http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2009:084
af854a3a-2127-422b-91ae-364da2661108http://www.mozilla.org/security/announce/2009/mfsa2009-13.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2009-0397.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2009-0398.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/502303/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34181Patch
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1021878
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/usn-745-1
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/0864Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.zerodayinitiative.com/advisories/ZDI-09-015
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.mozilla.org/show_bug.cgi?id=484320Patch
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11368
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01023.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01040.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html
Impacted products
Vendor Product Version
mozilla firefox 3.0.7
microsoft windows_7 *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:3.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "917E9856-9556-4FD6-A834-858F8837A6B4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D56B932B-9593-44E2-B610-E4EB2143EB21",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox versi\u00f3n 3.0.7 en Windows 7, permite a los atacantes remotos ejecutar c\u00f3digo arbitrario por medio de vectores desconocidos relacionados con el m\u00e9todo de \u00e1rbol _moveToEdgeShift XUL, que desencadena un garbage collection en objetos que todav\u00eda est\u00e1n en uso, como es demostrado por Nils durante la competici\u00f3n PWN2OWN en CanSecWest 2009."
    }
  ],
  "id": "CVE-2009-1044",
  "lastModified": "2026-06-16T23:06:22.983",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2009-03-23T14:19:12.593",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://blogs.zdnet.com/security/?p=2934"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://blogs.zdnet.com/security/?p=2941"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://cansecwest.com/index.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://news.cnet.com/8301-1009_3-10199652-83.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/52896"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34471"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34505"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34510"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34511"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34521"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34527"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34549"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34550"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34792"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://twitter.com/tippingpoint1/status/1351635812"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2009/dsa-1756"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:084"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-13.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-0397.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-0398.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/502303/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/34181"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1021878"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/usn-745-1"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/0864"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-015"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=484320"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11368"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01023.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01040.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blogs.zdnet.com/security/?p=2934"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blogs.zdnet.com/security/?p=2941"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://cansecwest.com/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://news.cnet.com/8301-1009_3-10199652-83.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/52896"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34471"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34505"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34510"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34511"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34521"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34527"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34549"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34550"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34792"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://twitter.com/tippingpoint1/status/1351635812"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1756"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:084"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2009/mfsa2009-13.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-0397.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2009-0398.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/502303/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/34181"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1021878"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/usn-745-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/0864"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-09-015"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=484320"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11368"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01040.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.