CVE catalog
CVE-2009-2462
xulrunner - several vulnerabilities
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition. Mozilla Browser engine crashes The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 5.41% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debian5.0 | xulrunner | 1.9.0.10-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.11-0lenny1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.11-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.12-0lenny1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.5-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.6-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.7-0lenny1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.7-0lenny2 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.7-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.8-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.9-0lenny2 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.9-1 | UnknownSource applicability is not established | [DSA-1840-1] |
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debian5.0 | xulrunner | 1.9.0.10-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.11-0lenny1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.11-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.12-0lenny1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.5-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.6-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.7-0lenny1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.7-0lenny2 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.7-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.8-1 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.9-0lenny2 | UnknownSource applicability is not established | [DSA-1840-1] |
| Debian5.0 | xulrunner | 1.9.0.9-1 | UnknownSource applicability is not established | [DSA-1840-1] |
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "xulrunner",
"distro": "debian",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.0.12-0lenny1"
}
]
}
],
"release": "5.0",
"versions": [
"1.9.0.10-1",
"1.9.0.11-0lenny1",
"1.9.0.11-1",
"1.9.0.5-1",
"1.9.0.6-1",
"1.9.0.7-0lenny1",
"1.9.0.7-0lenny2",
"1.9.0.7-1",
"1.9.0.8-1",
"1.9.0.9-0lenny2",
"1.9.0.9-1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/DSA-1840-1",
"fixed_version": "1.9.0.12-0lenny1",
"provider_source": "pypi",
"provider_record_id": "DSA-1840-1",
"provider_updated_at": "2026-03-09T01:20:51.041067Z",
"applicability_unknown": true
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed: