Vulnerability Details : CVE-2009-3379
Multiple unspecified vulnerabilities in libvorbis, as used in Mozilla Firefox 3.5.x before 3.5.4, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors. NOTE: this might overlap CVE-2009-2663.
Vulnerability category: Execute codeDenial of service
Products affected by CVE-2009-3379
- cpe:2.3:a:mozilla:firefox:3.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.5.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-3379
5.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 89 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-3379
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
References for CVE-2009-3379
-
https://bugzilla.mozilla.org/show_bug.cgi?id=500254
500254 - (CVE-2009-2663) Crash in vorbis_book_decodevv_add at vorbis_codebook.c:483Patch
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6582
404 Not Found
-
http://www.vupen.com/english/advisories/2009/3334
Site en construction
-
http://www.ubuntu.com/usn/USN-861-1
500: Server error | Ubuntu
-
https://bugzilla.mozilla.org/show_bug.cgi?id=501279
501279 - (CVE-2009-3379) Crash in [@ res0_unpack] at vorbis_res0.c:225
-
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00369.html
[SECURITY] Fedora 11 Update: libvorbis-1.2.0-9.fc11
-
http://www.mandriva.com/security/advisories?name=MDVSA-2009:294
Mandriva
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10993
404 Not Found
-
https://bugzilla.mozilla.org/show_bug.cgi?id=499512
499512 - Crash in OGG : res2_inverse at vorbis_res0.c:849
-
http://www.redhat.com/support/errata/RHSA-2009-1561.html
Support
-
http://www.mozilla.org/security/announce/2009/mfsa2009-63.html
Upgrade media libraries to fix memory safety bugs — MozillaPatch;Vendor Advisory
-
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00315.html
[SECURITY] Fedora 10 Update: libvorbis-1.2.0-7.fc10
-
http://secunia.com/advisories/37306
About Secunia Research | Flexera
-
http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1
-
https://bugzilla.mozilla.org/show_bug.cgi?id=507167
507167 - crash (segfault) @ _make_words when playing corrupted ogg vorbis file
-
http://secunia.com/advisories/37340
About Secunia Research | Flexera
-
https://bugzilla.mozilla.org/show_bug.cgi?id=515889
515889 - Possible overflow in Vorbis_cookbook.c
Jump to