CVE-2009-2463

EUVD-2009-2458
Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
0.1
mozillafirefox
0.2
mozillafirefox
0.3
mozillafirefox
0.4
mozillafirefox
0.5
mozillafirefox
0.6
mozillafirefox
0.6.1
mozillafirefox
0.7
mozillafirefox
0.7.1
mozillafirefox
0.8
mozillafirefox
0.9
mozillafirefox
0.9:rc
mozillafirefox
0.9.1
mozillafirefox
0.9.2
mozillafirefox
0.9.3
mozillafirefox
0.9_rc:_rc
mozillafirefox
0.10
mozillafirefox
0.10.1
mozillafirefox
1.0
mozillafirefox
1.0:preview_release
mozillafirefox
1.0.1
mozillafirefox
1.0.2
mozillafirefox
1.0.3
mozillafirefox
1.0.4
mozillafirefox
1.0.5
mozillafirefox
1.0.6
mozillafirefox
1.0.6
mozillafirefox
1.0.7
mozillafirefox
1.0.8
mozillafirefox
1.4.1
mozillafirefox
1.5
mozillafirefox
1.5:beta1
mozillafirefox
1.5:beta2
mozillafirefox
1.5.0.1
mozillafirefox
1.5.0.2
mozillafirefox
1.5.0.3
mozillafirefox
1.5.0.4
mozillafirefox
1.5.0.5
mozillafirefox
1.5.0.6
mozillafirefox
1.5.0.7
mozillafirefox
1.5.0.8
mozillafirefox
1.5.0.9
mozillafirefox
1.5.0.10
mozillafirefox
1.5.0.11
mozillafirefox
1.5.0.12
mozillafirefox
1.5.1
mozillafirefox
1.5.2
mozillafirefox
1.5.3
mozillafirefox
1.5.4
mozillafirefox
1.5.5
mozillafirefox
1.5.6
mozillafirefox
1.5.7
mozillafirefox
1.5.8
mozillafirefox
1.8
mozillafirefox
2.0
mozillafirefox
2.0:beta_1
mozillafirefox
2.0:beta1
mozillafirefox
2.0:rc2
mozillafirefox
2.0:rc3
mozillafirefox
2.0.0.1
mozillafirefox
2.0.0.2
mozillafirefox
2.0.0.3
mozillafirefox
2.0.0.4
mozillafirefox
2.0.0.5
mozillafirefox
2.0.0.6
mozillafirefox
2.0.0.7
mozillafirefox
2.0.0.8
mozillafirefox
2.0.0.9
mozillafirefox
2.0.0.10
mozillafirefox
2.0.0.11
mozillafirefox
2.0.0.12
mozillafirefox
2.0.0.13
mozillafirefox
2.0.0.14
mozillafirefox
2.0.0.15
mozillafirefox
2.0.0.16
mozillafirefox
2.0.0.17
mozillafirefox
2.0.0.18
mozillafirefox
2.0.0.19
mozillafirefox
2.0.0.20
mozillafirefox
2.0.0.21
mozillafirefox
2.0_.1:_.1
mozillafirefox
2.0_.4:_.4
mozillafirefox
2.0_.5:_.5
mozillafirefox
2.0_.6:_.6
mozillafirefox
2.0_.7:_.7
mozillafirefox
2.0_.9:_.9
mozillafirefox
2.0_.10:_.10
mozillafirefox
2.0_8:_8
mozillafirefox
3.0
mozillafirefox
3.0:alpha
mozillafirefox
3.0:beta2
mozillafirefox
3.0:beta5
mozillafirefox
3.0.1
mozillafirefox
3.0.2
mozillafirefox
3.0.3
mozillafirefox
3.0.4
mozillafirefox
3.0.5
mozillafirefox
3.0.6
mozillafirefox
3.0.7
mozillafirefox
3.0.8
mozillafirefox
3.0.9
mozillafirefox
3.0.10
mozillathunderbird
2.0.0.0
mozillathunderbird
2.0.0.1
mozillathunderbird
2.0.0.2
mozillathunderbird
2.0.0.3
mozillathunderbird
2.0.0.4
mozillathunderbird
2.0.0.5
mozillathunderbird
2.0.0.6
mozillathunderbird
2.0.0.7
mozillathunderbird
2.0.0.8
mozillathunderbird
2.0.0.9
mozillathunderbird
2.0.0.11
mozillathunderbird
2.0.0.12
mozillathunderbird
2.0.0.13
mozillathunderbird
2.0.0.14
mozillathunderbird
2.0.0.15
mozillathunderbird
2.0.0.16
mozillathunderbird
2.0.0.17
mozillathunderbird
2.0.0.18
mozillathunderbird
2.0.0.19
mozillathunderbird
2.0.0.20
mozillathunderbird
2.0.0.21
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nspr
bookworm
2:4.35-1
fixed
bullseye
2:4.29-1
fixed
sid
2:4.35-1.1
fixed
trixie
2:4.35-1.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
dapper
ignored
hardy
ignored
intrepid
dne
jaunty
dne
karmic
dne
lucid
not-affected
maverick
not-affected
natty
not-affected
oneiric
not-affected
mozilla-thunderbird
dapper
ignored
hardy
dne
intrepid
dne
jaunty
dne
karmic
dne
lucid
dne
maverick
dne
natty
dne
oneiric
dne
thunderbird
dapper
dne
hardy
Fixed 2.0.0.24+build1+nobinonly-0ubuntu0.8.04.1
released
intrepid
Fixed 2.0.0.24+build1+nobinonly-0ubuntu0.8.10.1
released
jaunty
Fixed 2.0.0.24+build1+nobinonly-0ubuntu0.9.04.1
released
karmic
Fixed 2.0.0.24+build1+nobinonly-0ubuntu0.9.10.1
released
lucid
not-affected
maverick
not-affected
natty
not-affected
oneiric
not-affected
xulrunner
dapper
dne
hardy
ignored
intrepid
ignored
jaunty
ignored
karmic
ignored
lucid
dne
maverick
dne
natty
dne
oneiric
dne
xulrunner-1.9
dapper
dne
hardy
Fixed 1.9.0.12+build1+nobinonly-0ubuntu0.8.04.1
released
intrepid
Fixed 1.9.0.12+build1+nobinonly-0ubuntu0.8.10.2
released
jaunty
Fixed 1.9.0.12+build1+nobinonly-0ubuntu0.9.04.1
released
karmic
dne
lucid
dne
maverick
dne
natty
dne
oneiric
dne
xulrunner-1.9.1
dapper
dne
hardy
dne
intrepid
dne
jaunty
Fixed 1.9.1.1+build1+nobinonly-0ubuntu0.9.04.1
released
karmic
Fixed 1.9.1.1+build1+nobinonly-0ubuntu1
released
lucid
dne
maverick
dne
natty
dne
oneiric
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
http://rhn.redhat.com/errata/RHSA-2009-1162.html
http://rhn.redhat.com/errata/RHSA-2009-1163.html
http://secunia.com/advisories/35914
http://secunia.com/advisories/35943
http://secunia.com/advisories/35944
http://secunia.com/advisories/35947
http://secunia.com/advisories/36005
http://secunia.com/advisories/36145
http://secunia.com/advisories/38977
http://secunia.com/advisories/39001
http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1
http://www.mozilla.org/security/announce/2009/mfsa2009-34.html
http://www.mozilla.org/security/announce/2010/mfsa2010-07.html
http://www.redhat.com/support/errata/RHSA-2010-0153.html
http://www.redhat.com/support/errata/RHSA-2010-0154.html
http://www.securityfocus.com/bid/35758
http://www.ubuntu.com/usn/USN-915-1
http://www.vupen.com/english/advisories/2009/1972
http://www.vupen.com/english/advisories/2009/2152
http://www.vupen.com/english/advisories/2010/0648
http://www.vupen.com/english/advisories/2010/0650
https://bugzilla.mozilla.org/show_bug.cgi?id=492779
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10369
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01032.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
http://rhn.redhat.com/errata/RHSA-2009-1162.html
http://rhn.redhat.com/errata/RHSA-2009-1163.html
http://secunia.com/advisories/35914
http://secunia.com/advisories/35943
http://secunia.com/advisories/35944
http://secunia.com/advisories/35947
http://secunia.com/advisories/36005
http://secunia.com/advisories/36145
http://secunia.com/advisories/38977
http://secunia.com/advisories/39001
http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1
http://www.mozilla.org/security/announce/2009/mfsa2009-34.html
http://www.mozilla.org/security/announce/2010/mfsa2010-07.html
http://www.redhat.com/support/errata/RHSA-2010-0153.html
http://www.redhat.com/support/errata/RHSA-2010-0154.html
http://www.securityfocus.com/bid/35758
http://www.ubuntu.com/usn/USN-915-1
http://www.vupen.com/english/advisories/2009/1972
http://www.vupen.com/english/advisories/2009/2152
http://www.vupen.com/english/advisories/2010/0648
http://www.vupen.com/english/advisories/2010/0650
https://bugzilla.mozilla.org/show_bug.cgi?id=492779
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10369
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01032.html