Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2009-0689 Details

Description

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h	CVE	Patch
http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html	CVE
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	CVE	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html	CVE
http://rhn.redhat.com/errata/RHSA-2014-0311.html	CVE
http://rhn.redhat.com/errata/RHSA-2014-0312.html	CVE
https://bugzilla.mozilla.org/show_bug.cgi?id=516396	CVE
https://bugzilla.mozilla.org/show_bug.cgi?id=516862	CVE
http://secunia.com/advisories/37431	CVE	Vendor Advisory
http://secunia.com/advisories/37682	CVE	Vendor Advisory
http://secunia.com/advisories/37683	CVE	Vendor Advisory
http://secunia.com/advisories/38066	CVE	Vendor Advisory
http://secunia.com/advisories/38977	CVE	Vendor Advisory
http://secunia.com/advisories/39001	CVE	Vendor Advisory
http://secunia.com/secunia_research/2009-35/	CVE	Vendor Advisory
http://securityreason.com/achievement_securityalert/63	CVE	Exploit
http://securityreason.com/achievement_securityalert/69	CVE
http://securityreason.com/achievement_securityalert/71	CVE
http://securityreason.com/achievement_securityalert/72	CVE
http://securityreason.com/achievement_securityalert/73	CVE
http://securityreason.com/achievement_securityalert/75	CVE
http://securityreason.com/achievement_securityalert/76	CVE
http://securityreason.com/achievement_securityalert/77	CVE
http://securityreason.com/achievement_securityalert/78	CVE
http://securityreason.com/achievement_securityalert/81	CVE
http://securitytracker.com/id?1022478	CVE	Patch
https://lists.debian.org/debian-lts-announce/2018/11/msg00001.html	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6528	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9541	CVE
http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1	CVE
http://support.apple.com/kb/HT4077	CVE
http://support.apple.com/kb/HT4225	CVE
http://www.mandriva.com/security/advisories?name=MDVSA-2009:294	CVE
http://www.mandriva.com/security/advisories?name=MDVSA-2009:330	CVE
http://www.mozilla.org/security/announce/2009/mfsa2009-59.html	CVE	Vendor Advisory
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/misc.c	CVE	PatchVendor Advisory
http://www.opera.com/support/kb/view/942/	CVE
http://www.redhat.com/support/errata/RHSA-2009-1601.html	CVE
http://www.redhat.com/support/errata/RHSA-2010-0153.html	CVE
http://www.redhat.com/support/errata/RHSA-2010-0154.html	CVE
http://www.securityfocus.com/archive/1/507977/100/0/threaded	CVE
http://www.securityfocus.com/archive/1/507979/100/0/threaded	CVE
http://www.securityfocus.com/archive/1/508417/100/0/threaded	CVE
http://www.securityfocus.com/archive/1/508423/100/0/threaded	CVE
http://www.securityfocus.com/bid/35510	CVE	ExploitPatch
http://www.ubuntu.com/usn/USN-915-1	CVE
http://www.vupen.com/english/advisories/2009/3297	CVE	Vendor Advisory
http://www.vupen.com/english/advisories/2009/3299	CVE	Vendor Advisory
http://www.vupen.com/english/advisories/2009/3334	CVE	Vendor Advisory
http://www.vupen.com/english/advisories/2010/0094	CVE	Vendor Advisory
http://www.vupen.com/english/advisories/2010/0648	CVE	Vendor Advisory
http://www.vupen.com/english/advisories/2010/0650	CVE	Vendor Advisory
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h	[email protected]	Patch
http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html	[email protected]
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	[email protected]	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html	[email protected]
http://rhn.redhat.com/errata/RHSA-2014-0311.html	[email protected]
http://rhn.redhat.com/errata/RHSA-2014-0312.html	[email protected]
https://bugzilla.mozilla.org/show_bug.cgi?id=516396	[email protected]
https://bugzilla.mozilla.org/show_bug.cgi?id=516862	[email protected]
http://secunia.com/advisories/37431	[email protected]	Vendor Advisory
http://secunia.com/advisories/37682	[email protected]	Vendor Advisory
http://secunia.com/advisories/37683	[email protected]	Vendor Advisory
http://secunia.com/advisories/38066	[email protected]	Vendor Advisory
http://secunia.com/advisories/38977	[email protected]	Vendor Advisory
http://secunia.com/advisories/39001	[email protected]	Vendor Advisory
http://secunia.com/secunia_research/2009-35/	[email protected]	Vendor Advisory
http://securityreason.com/achievement_securityalert/63	[email protected]	Exploit
http://securityreason.com/achievement_securityalert/69	[email protected]
http://securityreason.com/achievement_securityalert/71	[email protected]
http://securityreason.com/achievement_securityalert/72	[email protected]
http://securityreason.com/achievement_securityalert/73	[email protected]
http://securityreason.com/achievement_securityalert/75	[email protected]
http://securityreason.com/achievement_securityalert/76	[email protected]
http://securityreason.com/achievement_securityalert/77	[email protected]
http://securityreason.com/achievement_securityalert/78	[email protected]
http://securityreason.com/achievement_securityalert/81	[email protected]
http://securitytracker.com/id?1022478	[email protected]	Patch
https://lists.debian.org/debian-lts-announce/2018/11/msg00001.html	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6528	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9541	[email protected]
http://sunsolve.sun.com/search/document.do?assetkey=1-26-272909-1	[email protected]
http://support.apple.com/kb/HT4077	[email protected]
http://support.apple.com/kb/HT4225	[email protected]
http://www.mandriva.com/security/advisories?name=MDVSA-2009:294	[email protected]
http://www.mandriva.com/security/advisories?name=MDVSA-2009:330	[email protected]
http://www.mozilla.org/security/announce/2009/mfsa2009-59.html	[email protected]	Vendor Advisory
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/misc.c	[email protected]	PatchVendor Advisory
http://www.opera.com/support/kb/view/942/	[email protected]
http://www.redhat.com/support/errata/RHSA-2009-1601.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2010-0153.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2010-0154.html	[email protected]
http://www.securityfocus.com/archive/1/507977/100/0/threaded	[email protected]
http://www.securityfocus.com/archive/1/507979/100/0/threaded	[email protected]
http://www.securityfocus.com/archive/1/508417/100/0/threaded	[email protected]
http://www.securityfocus.com/archive/1/508423/100/0/threaded	[email protected]
http://www.securityfocus.com/bid/35510	[email protected]	ExploitPatch
http://www.ubuntu.com/usn/USN-915-1	[email protected]
http://www.vupen.com/english/advisories/2009/3297	[email protected]	Vendor Advisory
http://www.vupen.com/english/advisories/2009/3299	[email protected]	Vendor Advisory
http://www.vupen.com/english/advisories/2009/3334	[email protected]	Vendor Advisory
http://www.vupen.com/english/advisories/2010/0094	[email protected]	Vendor Advisory
http://www.vupen.com/english/advisories/2010/0648	[email protected]	Vendor Advisory
http://www.vupen.com/english/advisories/2010/0650	[email protected]	Vendor Advisory

see all 106 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	[email protected]

Affected Products

Product	Versions
k-meleon project k-meleon	1.5.3
CPE cpe:2.3:a:k-meleon_project:k-meleon:1.5.3:::::::* Remediation No remediation found in references.
mozilla firefox	3.0.1 3.0.2 3.0.3 3.0.4 3.0.5
CPE cpe:2.3:a:mozilla:firefox:3.0.1:::::::* cpe:2.3:a:mozilla:firefox:3.0.2:::::::* cpe:2.3:a:mozilla:firefox:3.0.3:::::::* cpe:2.3:a:mozilla:firefox:3.0.4:::::::* cpe:2.3:a:mozilla:firefox:3.0.5:::::::* cpe:2.3:a:mozilla:firefox:3.0.6:::::::* cpe:2.3:a:mozilla:firefox:3.0.7:::::::* cpe:2.3:a:mozilla:firefox:3.0.8:::::::* cpe:2.3:a:mozilla:firefox:3.0.9:::::::* cpe:2.3:a:mozilla:firefox:3.0.10:::::::* cpe:2.3:a:mozilla:firefox:3.0.11:::::::* cpe:2.3:a:mozilla:firefox:3.0.12:::::::* cpe:2.3:a:mozilla:firefox:3.0.13:::::::* cpe:2.3:a:mozilla:firefox:3.0.14:::::::* cpe:2.3:a:mozilla:firefox:3.5:::::::* cpe:2.3:a:mozilla:firefox:3.5.1:::::::* cpe:2.3:a:mozilla:firefox:3.5.2:::::::* cpe:2.3:a:mozilla:firefox:3.5.3:::::::* Remediation No remediation found in references.
mozilla seamonkey	1.1.8
CPE cpe:2.3:a:mozilla:seamonkey:1.1.8:::::::* Remediation No remediation found in references.
freebsd freebsd	6.4 6.4 release 6.4 release_p2 6.4 release_p3 6.4 release_p4
CPE cpe:2.3:o:freebsd:freebsd:6.4:::::::* cpe:2.3:o:freebsd:freebsd:6.4:release:::::: cpe:2.3:o:freebsd:freebsd:6.4:release_p2:::::: cpe:2.3:o:freebsd:freebsd:6.4:release_p3:::::: cpe:2.3:o:freebsd:freebsd:6.4:release_p4:::::: cpe:2.3:o:freebsd:freebsd:6.4:release_p5:::::: cpe:2.3:o:freebsd:freebsd:6.4:stable:::::: cpe:2.3:o:freebsd:freebsd:7.2:::::::* cpe:2.3:o:freebsd:freebsd:7.2:pre-release:::::: cpe:2.3:o:freebsd:freebsd:7.2:stable:::::: Remediation No remediation found in references.
netbsd netbsd	5.0
CPE cpe:2.3:o:netbsd:netbsd:5.0:::::::* Remediation No remediation found in references.
openbsd openbsd	4.5
CPE cpe:2.3:o:openbsd:openbsd:4.5:::::::* Remediation No remediation found in references.

Change History

8 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 2, 2018	CVE Modified	[email protected]
Oct 10, 2018	CVE Modified	[email protected]
Sep 29, 2017	CVE Modified	[email protected]
Jul 1, 2009	Initial Analysis	[email protected]

CVE-2009-0689 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO