CVE-2009-0071
Summary
| CVE | CVE-2009-0071 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-01-08 19:30:11 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Mozilla Firefox 3.0.5 and earlier 3.0.x versions, when designMode is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a certain (a) replaceChild or (b) removeChild call, followed by a (1) queryCommandValue, (2) queryCommandState, or (3) queryCommandIndeterm call. NOTE: it was later reported that 3.0.6 and 3.0.7 are also affected. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
NoneIntegrity
NoneAvailability
PartialAV:N/AC:H/Au:N/C:N/I:N/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mozilla | Firefox | 3.0 | All | All | All |
| Application | Mozilla | Firefox | 3.0 | alpha | All | All |
| Application | Mozilla | Firefox | 3.0 | beta2 | All | All |
| Application | Mozilla | Firefox | 3.0 | beta5 | All | All |
| Application | Mozilla | Firefox | 3.0.1 | All | All | All |
| Application | Mozilla | Firefox | 3.0.2 | All | All | All |
| Application | Mozilla | Firefox | 3.0.3 | All | All | All |
| Application | Mozilla | Firefox | 3.0.4 | All | All | All |
| Application | Mozilla | Firefox | 3.0.5 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 472507 – full disclosure DOS crash at [@ nsHTMLEditor::GetCSSBackgroundColorState(int*, nsAString_internal&, int) ] | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | |
| Mozilla Firefox 3.0.6 (BODY onload) Remote Crash Exploit | af854a3a-2127-422b-91ae-364da2661108 | www.exploit-db.com | |
| 448329 – Browser crashes after hitting the "tab" key within Smatermail webmail app [@ nsHTMLEditor::GetCSSBackgroundColorState] | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | |
| NEOHAPSIS - Peace of Mind Through Integrity and Insight | af854a3a-2127-422b-91ae-364da2661108 | archives.neohapsis.com | |
| archives.neohapsis.com/archives/fulldisclosure/2009-01/0224.html | af854a3a-2127-422b-91ae-364da2661108 | archives.neohapsis.com | |
| archives.neohapsis.com/archives/fulldisclosure/2009-01/0223.html | af854a3a-2127-422b-91ae-364da2661108 | archives.neohapsis.com | |
| Mozilla Firefox 'designMode' Null Pointer Dereference Denial of Service Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit |
| Mozilla Firefox 3.0.7 - OnbeforeUnLoad DesignMode Dereference Crash - Multiple dos Exploit | af854a3a-2127-422b-91ae-364da2661108 | www.exploit-db.com | |
| 456727 – document designMode on, replace/delete HTML tag, queryCommand*('backcolor'); causes NULL pointer | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-01-19 | Joshua Bressers | Red Hat does not consider a crash of a client application such as Firefox to be a security issue. |
There are currently no legacy QID mappings associated with this CVE.