| Vulnerability Name: | CVE-2009-3978 (CCN-54376) |
| Assigned: | 2009-10-29 |
| Published: | 2009-10-29 |
| Updated: | 2009-11-19 |
| Summary: | The nsGIFDecoder2::GifWrite function in decoders/gif/nsGIFDecoder2.cpp in libpr0n in Mozilla Firefox before 3.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an animated GIF file with a large image size, a different vulnerability than CVE-2009-3373.
|
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): None
Availibility (A): Low |
|
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial |
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial |
|
| Vulnerability Type: | CWE-Other
|
| Vulnerability Consequences: | Denial of Service |
| References: | Source: MITRE
Type: CNA
CVE-2009-3978
Source: CONFIRM
Type: UNKNOWN
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/edf189567edc
Source: MISC
Type: Patch
http://www.h-online.com/open/news/item/Mozilla-fixes-critical-bugs-with-Firefox-3-5-5-852070.html
Source: MISC
Type: Patch
http://www.mozilla.com/en-US/firefox/3.5.5/releasenotes/
Source: CCN
Type: Mozilla Web site
Firefox - Rediscover the web
Source: CCN
Type: BID-37107
Mozilla Firefox 'libpr0n' GIF File Handling Denial of Service Vulnerability
Source: CCN
Type: Bugzilla@Mozilla - Bug 525326
Crashes in gif decoder
Source: CONFIRM
Type: UNKNOWN
https://bugzilla.mozilla.org/show_bug.cgi?id=525326
Source: XF
Type: UNKNOWN
firefox-nsgifdecoder2-dos(54376)
Source: CONFIRM
Type: Patch
https://wiki.mozilla.org/Releases/Firefox_3.5.5/Test_Plan
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:mozilla:firefox:0.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.6.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.7.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.4.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.0:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version <= 3.5.4)
Configuration CCN 1:
cpe:/a:mozilla:firefox:3.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:3.5.4:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| Oval Definitions |
|
| BACK |