CVE-2009-1313 Memory corruption in n/a

Critical 9.3 Published 30 Apr 2009 Updated 7 Aug 2024

Remote attackers can cause memory corruption and potentially execute arbitrary code in Mozilla Firefox via unspecified vectors, requiring user interaction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2009-1313?

CVE-2009-1313 is a critical memory corruption vulnerability in Mozilla Firefox, published on 30 Apr 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The nsTextFrame::ClearTextRun function in layout/generic/nsTextFrameThebes.cpp in Mozilla Firefox 3.0.9 allows remote attackers to cause a denial of service (memory corruption) and probably execute arbitrary code via unspecified vectors. NOTE: this vulnerability reportedly exists because of an incorrect fix for CVE-2009-1302.

Weakness: CWE-399

Which versions are affected by CVE-2009-1313?

It affects 1 product.

Linux distribution packages (22)

`firefox` Red Hat:enterprise_linux:4::as	All versions	`0:3.0.10-1.el4`
`firefox-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:3.0.10-1.el4`
`firefox` Red Hat:enterprise_linux:4::desktop	All versions	`0:3.0.10-1.el4`
`firefox-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:3.0.10-1.el4`
`firefox` Red Hat:enterprise_linux:4::es	All versions	`0:3.0.10-1.el4`
`firefox-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:3.0.10-1.el4`
`firefox` Red Hat:enterprise_linux:4::ws	All versions	`0:3.0.10-1.el4`
`firefox-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:3.0.10-1.el4`
`firefox` Red Hat:enterprise_linux:5::client	All versions	`0:3.0.10-1.el5`
`firefox-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:3.0.10-1.el5`
`xulrunner` Red Hat:enterprise_linux:5::client	All versions	`0:1.9.0.10-1.el5`
`xulrunner-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:1.9.0.10-1.el5`
`xulrunner` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.9.0.10-1.el5`
`xulrunner-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.9.0.10-1.el5`
`xulrunner-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.9.0.10-1.el5`
`xulrunner-devel-unstable` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.9.0.10-1.el5`
`firefox` Red Hat:enterprise_linux:5::server	All versions	`0:3.0.10-1.el5`
`firefox-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:3.0.10-1.el5`
`xulrunner` Red Hat:enterprise_linux:5::server	All versions	`0:1.9.0.10-1.el5`
`xulrunner-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.9.0.10-1.el5`
`xulrunner-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.9.0.10-1.el5`
`xulrunner-devel-unstable` Red Hat:enterprise_linux:5::server	All versions	`0:1.9.0.10-1.el5`

Products include Mozilla Firefox.

How do I fix CVE-2009-1313?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2009-1313 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-1313 exists.

Public exploit code: 1 Exploit-DB entry.

All Mozilla Firefox vulnerabilities

Sources

Also known as GHSA-ph69-fr9j-4gj2, RHSA-2009:0449.