{"id":"CVE-2009-2477","aliases":["EUVD-2009-2472","GHSA-p5fj-7pgr-xv7v"],"status":"published","title":"js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla...","description":"js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.4254,"percentile":0.98716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2009-07-15T15:00:00Z","modified":"2026-06-16T23:09:32Z","exploits":[{"source":"exploitdb","id":"EDB-16299","title":"Mozilla Firefox 3.5 - 'escape()' Return Value Memory Corruption (Metasploit)","type":"remote","platform":"multiple","date":"2010-09-20","verified":true,"url":"https://www.exploit-db.com/exploits/16299"},{"source":"exploitdb","id":"EDB-40936","title":"Naenara Browser 3.5 (RedStar 3.0 Desktop) - 'JACKRABBIT' Client-Side Command Execution","type":"local","platform":"linux","date":"2016-12-18","verified":true,"url":"https://www.exploit-db.com/exploits/40936"},{"source":"exploitdb","id":"EDB-9137","title":"Mozilla Firefox 3.5 - Font tags Remote Buffer Overflow","type":"remote","platform":"windows","date":"2009-07-13","verified":true,"url":"https://www.exploit-db.com/exploits/9137"},{"source":"exploitdb","id":"EDB-9214","title":"Mozilla Firefox 3.5 - 'Font tags' Remote HeapSpray (2)","type":"remote","platform":"windows","date":"2009-07-20","verified":true,"url":"https://www.exploit-db.com/exploits/9214"},{"source":"metasploit","id":"exploit/multi/browser/firefox_escape_retval","title":"Firefox 3.5 escape() Return Value Memory Corruption","type":"exploit","platform":"OSX,Windows","date":"2009-07-13","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/browser/firefox_escape_retval"}],"products":[{"vendor":"mozilla","product":"firefox"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=503286","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/443060","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/40936/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical_firef.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://isc.sans.org/diary.html?storyid=6796","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred"]},{"url":"http://www.securityfocus.com/bid/35660","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"http://www.exploit-db.com/exploits/9181","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://secunia.com/advisories/35798","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2009/1868","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.exploit-db.com/exploits/9137","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.mozilla.org/security/announce/2009/mfsa2009-41.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2477"},{"url":"https://www.exploit-db.com/exploits/40936"},{"url":"http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35"},{"url":"https://github.com/advisories/GHSA-p5fj-7pgr-xv7v"}],"sources":{"cve":[{"id":"CVE-2009-2477","description":"js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.","status":"published","published":"2009-07-15T15:00:00Z","modified":"2024-08-07T05:52:14.977Z","updated_at":"2026-11-02T14:33:23.395558Z"}],"euvd":[{"id":"EUVD-2009-2472","description":"js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.","status":"published","published":"2009-07-15T15:00:00Z","modified":"2024-08-07T05:52:14Z","updated_at":"2026-11-03T01:39:17.521372Z"}],"ghsa":[{"id":"GHSA-p5fj-7pgr-xv7v","title":"js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla...","description":"js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.","status":"published","published":"2022-05-02T03:35:38Z","modified":"2025-04-09T04:12:01Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:01:00.53445Z"}],"nvd":[{"id":"CVE-2009-2477","description":"js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.","status":"published","published":"2009-07-15T15:30:01.453Z","modified":"2026-06-16T23:09:32.107Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:01:36.200173Z"}]}}