CVE-2009-2462
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to...
10.0 HighFix available
CVE-2009-2462 is a high vulnerability (CVSS 10.0) in Mozilla Firefox, published July 22, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.41%, the 92nd percentile. Fixed in xulrunner 1.9.0.12-0lenny1.
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition.
Exploit likelihood
5.41%Down 2.8 points since Feb 4, 2022
What each source reports
NVD Score used
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition.
- Record
CVE-2009-2462- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition.
- Record
CVE-2009-2462- Updated
- 2026-11-02
EUVDEUVD-2009-2457 No score
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition.
- Record
EUVD-2009-2457- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gphm-8f5h-pv33 No score
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to...
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition.
- Record
GHSA-gphm-8f5h-pv33- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xulrunnerDebian:5.0 |
before 1.9.0.12-0lenny1, plus listed versions 1.9.0.10-11.9.0.11-0lenny11.9.0.11-11.9.0.5-11.9.0.6-1 Show 6 moreShow less1.9.0.7-0lenny11.9.0.7-0lenny21.9.0.7-11.9.0.8-11.9.0.9-0lenny21.9.0.9-1 |
1.9.0.12-0lenny1 |
firefoxRed Hat:enterprise_linux:4::as |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::as |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefoxRed Hat:enterprise_linux:4::desktop |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefoxRed Hat:enterprise_linux:4::es |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::es |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefoxRed Hat:enterprise_linux:4::ws |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:3.0.12-1.el4 | 0:3.0.12-1.el4 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
Show 97 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-devel-unstableRed Hat:enterprise_linux:5::client_workstation |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
firefoxRed Hat:enterprise_linux:5::client |
before 0:3.0.12-1.el5_3 | 0:3.0.12-1.el5_3 |
firefox-debuginfoRed Hat:enterprise_linux:5::client |
before 0:3.0.12-1.el5_3 | 0:3.0.12-1.el5_3 |
xulrunnerRed Hat:enterprise_linux:5::client |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
firefoxRed Hat:enterprise_linux:5::server |
before 0:3.0.12-1.el5_3 | 0:3.0.12-1.el5_3 |
firefox-debuginfoRed Hat:enterprise_linux:5::server |
before 0:3.0.12-1.el5_3 | 0:3.0.12-1.el5_3 |
xulrunnerRed Hat:enterprise_linux:5::server |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-develRed Hat:enterprise_linux:5::server |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
xulrunner-devel-unstableRed Hat:enterprise_linux:5::server |
before 0:1.9.0.12-1.el5_3 | 0:1.9.0.12-1.el5_3 |
seamonkeyRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-develRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkeyRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkeyRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-develRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkeyRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.40.el3 | 0:1.0.9-0.40.el3 |
seamonkeyRed Hat:enterprise_linux:4::as |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-chatRed Hat:enterprise_linux:4::as |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-develRed Hat:enterprise_linux:4::as |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::as |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::as |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-mailRed Hat:enterprise_linux:4::as |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkeyRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-chatRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-develRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-mailRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkeyRed Hat:enterprise_linux:4::es |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-chatRed Hat:enterprise_linux:4::es |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-develRed Hat:enterprise_linux:4::es |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::es |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::es |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-mailRed Hat:enterprise_linux:4::es |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkeyRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-chatRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-develRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
seamonkey-mailRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-45.el4_8 | 0:1.0.9-45.el4_8 |
thunderbirdRed Hat:enterprise_linux:5::client |
before 0:2.0.0.24-2.el5_4 | 0:2.0.0.24-2.el5_4 |
thunderbird-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.0.0.24-2.el5_4 | 0:2.0.0.24-2.el5_4 |
thunderbirdRed Hat:rhel_productivity:5 |
before 0:2.0.0.24-2.el5_4 | 0:2.0.0.24-2.el5_4 |
thunderbird-debuginfoRed Hat:rhel_productivity:5 |
before 0:2.0.0.24-2.el5_4 | 0:2.0.0.24-2.el5_4 |
thunderbirdRed Hat:enterprise_linux:4::as |
before 0:1.5.0.12-25.el4 | 0:1.5.0.12-25.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.5.0.12-25.el4 | 0:1.5.0.12-25.el4 |
thunderbirdRed Hat:enterprise_linux:4::desktop |
before 0:1.5.0.12-25.el4 | 0:1.5.0.12-25.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.5.0.12-25.el4 | 0:1.5.0.12-25.el4 |
thunderbirdRed Hat:enterprise_linux:4::es |
before 0:1.5.0.12-25.el4 | 0:1.5.0.12-25.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.5.0.12-25.el4 | 0:1.5.0.12-25.el4 |
thunderbirdRed Hat:enterprise_linux:4::ws |
before 0:1.5.0.12-25.el4 | 0:1.5.0.12-25.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.5.0.12-25.el4 | 0:1.5.0.12-25.el4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1
redhat.com/support/errata/RHSA-2010-0153.html
bugzilla.mozilla.org/show_bug.cgi?id=463350
Show 142 moreShow less
secunia.com/advisories/36145
vupen.com/english/advisories/2010/0650
lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html
rhn.redhat.com/errata/RHSA-2009-1162.html
mozilla.org/security/announce/2009/mfsa2009-34.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10906
securityfocus.com/bid/35758
nvd.nist.gov/vuln/detail/CVE-2009-2462
github.com/advisories/GHSA-gphm-8f5h-pv33
access.redhat.com/errata/RHSA-2009:1162
bugzilla.redhat.com/show_bug.cgi?id=512128
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1162.json
cve.org/CVERecord?id=CVE-2009-2462