Skip to content
OpenAdvisories
Unscored Public exploit CVE-2009-0689 EUVD-2009-0689GHSA-99jp-rppc-jgcm

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in…

Published Jul 1, 2009 · Updated Aug 7, 2024 · Assigned by certcc

Package: mono Package: nspr Ecosystem: Debian

Description

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 mono 4.2.1.102+dfsg2-4 —
Debian 14 nspr 4.8-2 —
Debian 13 mono 4.2.1.102+dfsg2-4 —
Debian 13 nspr 4.8-2 —
Debian 12 mono 4.2.1.102+dfsg2-4 —
Debian 12 nspr 4.8-2 —
Debian 8 mono 3.2.8+dfsg-10+deb8u1 DLA-1564-1
Debian 6.0 mono 2.6.7-5.1+deb6u2 DLA-376-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 5.0 kdelibs 4:3.5.10.dfsg.1-0lenny4 DSA-1998-1
Debian 5.0 nspr 4.7.1-5 DSA-1931-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 5 firefox 3.0.15-3.el5_4 RHSA-2009:1530
RHEL 5 kdelibs +2 6:3.5.4-25.el5_4.1 RHSA-2009:1601
RHEL 5 nspr +1 4.7.6-1.el5_4 RHSA-2009:1530
RHEL 5 php +18 5.1.6-44.el5_10 RHSA-2014:0311
RHEL 5 thunderbird 2.0.0.24-2.el5_4 RHSA-2010:0153
RHEL 5 xulrunner +2 1.9.0.15-3.el5_4 RHSA-2009:1530
RHEL 4 firefox 3.0.15-3.el4 RHSA-2009:1530
RHEL 4 kdelibs +1 6:3.3.1-17.el4_8.1 RHSA-2009:1601
RHEL 4 nspr +1 4.7.6-1.el4_8 RHSA-2009:1530
RHEL 4 seamonkey +5 1.0.9-50.el4_8 RHSA-2009:1531
RHEL 4 thunderbird 1.5.0.12-25.el4 RHSA-2010:0154
RHEL 3 seamonkey +9 1.0.9-0.47.el3 RHSA-2009:1531
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Productivity 5 thunderbird 2.0.0.24-2.el5_4 RHSA-2010:0153
Red Hat Rhel Mission Critical 5 php +18 5.1.6-23.6.el5_3 RHSA-2014:0312
RHEL 5.9 EUS php +18 5.1.6-40.el5_9.2 RHSA-2014:0312

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 11 SP4 mono-core 2.6.7-0.16.1 SUSE-SU-2016:2958-1, SUSE-SU-2016:0257-1
SLES 11 SP3 mono-core 2.6.7-0.16.1 SUSE-SU-2016:2958-1, SUSE-SU-2016:0257-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 11 SP4 mono-core 2.6.7-0.16.1 SUSE-SU-2016:2958-1, SUSE-SU-2016:0257-1
SLES for SAP 11 SP3 mono-core 2.6.7-0.16.1 SUSE-SU-2016:0257-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 11

GitHub 1 repository

  • Fullmetal5/str2hax ★ 89 · Dec 18, 2018

    An implementation of CVE-2009-0689 for the Nintendo Wii.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 13

References