CVE-2009-2975
Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely...
Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely configured protocol handler, does not properly implement setting the document.location property to a value specifying a protocol associated with an external application, which allows remote attackers to cause a denial of service (memory consumption) via vectors involving a series of function calls that set this property, as demonstrated by (1) the chromehtml: protocol and (2) the aim: protocol.
Exploit likelihood
What each source reports
NVD Score used
Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely configured protocol handler, does not properly implement setting the document.location property to a value specifying a protocol associated with an external application, which allows remote attackers to cause a denial of service (memory consumption) via vectors involving a series of function calls that set this property, as demonstrated by (1) the chromehtml: protocol and (2) the aim: protocol.
- Record
CVE-2009-2975- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely configured protocol handler, does not properly implement setting the document.location property to a value specifying a protocol associated with an external application, which allows remote attackers to cause a denial of service (memory consumption) via vectors involving a series of function calls that set this property, as demonstrated by (1) the chromehtml: protocol and (2) the aim: protocol.
- Record
CVE-2009-2975- Updated
- 2026-11-02
EUVDEUVD-2009-2960 No score
Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely configured protocol handler, does not properly implement setting the document.location property to a value specifying a protocol associated with an external application, which allows remote attackers to cause a denial of service (memory consumption) via vectors involving a series of function calls that set this property, as demonstrated by (1) the chromehtml: protocol and (2) the aim: protocol.
- Record
EUVD-2009-2960- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g93w-x36g-q7gg No score
Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely...
Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely configured protocol handler, does not properly implement setting the document.location property to a value specifying a protocol associated with an external application, which allows remote attackers to cause a denial of service (memory consumption) via vectors involving a series of function calls that set this property, as demonstrated by (1) the chromehtml: protocol and (2) the aim: protocol.
- Record
GHSA-g93w-x36g-q7gg- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2975 is a medium vulnerability (CVSS 5.0) in Mozilla Firefox, published August 27, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.05%, the 81st percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/52923
archives.neohapsis.com/archives/bugtraq/2009-08/0234.html
nvd.nist.gov/vuln/detail/CVE-2009-2975
github.com/advisories/GHSA-g93w-x36g-q7gg