CVE-2009-2664
The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox...
The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a "memory safety bug." NOTE: this was originally reported as affecting versions before 3.0.13.
Exploit likelihood
What each source reports
NVD Score used
The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a "memory safety bug." NOTE: this was originally reported as affecting versions before 3.0.13.
- Record
CVE-2009-2664- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a "memory safety bug." NOTE: this was originally reported as affecting versions before 3.0.13.
- Record
CVE-2009-2664- Updated
- 2026-11-02
EUVDEUVD-2009-2657 No score
The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a "memory safety bug." NOTE: this was originally reported as affecting versions before 3.0.13.
- Record
EUVD-2009-2657- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-89w9-2j44-v823 No score
The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox...
The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute arbitrary code via a crafted .js file, related to a "memory safety bug." NOTE: this was originally reported as affecting versions before 3.0.13.
- Record
GHSA-89w9-2j44-v823- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xulrunnerDebian:5.0 From an advisory covering 3 CVEs |
before 1.9.0.13-0lenny1, plus listed versions 1.9.0.10-11.9.0.11-0lenny11.9.0.11-11.9.0.12-0lenny11.9.0.12-1 Show 8 moreShow less1.9.0.5-11.9.0.6-11.9.0.7-0lenny11.9.0.7-0lenny21.9.0.7-11.9.0.8-11.9.0.9-0lenny21.9.0.9-1 |
1.9.0.13-0lenny1 |
firefoxRed Hat:enterprise_linux:4::as From an advisory covering 11 CVEs |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 11 CVEs |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefoxRed Hat:enterprise_linux:4::desktop From an advisory covering 11 CVEs |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 11 CVEs |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefoxRed Hat:enterprise_linux:4::es From an advisory covering 11 CVEs |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 11 CVEs |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefoxRed Hat:enterprise_linux:4::ws From an advisory covering 11 CVEs |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 11 CVEs |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-devel-unstableRed Hat:enterprise_linux:5::client_workstation From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
firefoxRed Hat:enterprise_linux:5::client From an advisory covering 11 CVEs |
before 0:3.0.12-1.el5_3 | 0:3.0.12-1.el5_3 |
firefox-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 11 CVEs |
before 0:3.0.12-1.el5_3 | 0:3.0.12-1.el5_3 |
xulrunnerRed Hat:enterprise_linux:5::client From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
firefoxRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:3.0.12-1.el5_3 | 0:3.0.12-1.el5_3 |
firefox-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:3.0.12-1.el5_3 | 0:3.0.12-1.el5_3 |
xulrunnerRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-develRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-devel-unstableRed Hat:enterprise_linux:5::server From an advisory covering 11 CVEs |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2664 is a medium vulnerability (CVSS 5.0) in Mozilla Firefox, published August 4, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.80%, the 86th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2009/2142
mozilla.org/security/announce/2009/mfsa2009-45.html
sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1
redhat.com/archives/fedora-package-announce/2009-August/msg00261.html
secunia.com/advisories/36126
Show 52 moreShow less
securityfocus.com/bid/35927
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9806
bugzilla.mozilla.org/show_bug.cgi?id=501270
nvd.nist.gov/vuln/detail/CVE-2009-2664
github.com/advisories/GHSA-89w9-2j44-v823
access.redhat.com/errata/RHSA-2009:1162
bugzilla.redhat.com/show_bug.cgi?id=512128
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1162.json
cve.org/CVERecord?id=CVE-2009-2462