Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2009-1044 Details

Description

Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://blogs.zdnet.com/security/?p=2934	CVE
http://blogs.zdnet.com/security/?p=2941	CVE
http://cansecwest.com/index.html	CVE
http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009	CVE
http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits	CVE
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html	CVE
http://news.cnet.com/8301-1009_3-10199652-83.html	CVE
http://osvdb.org/52896	CVE
https://bugzilla.mozilla.org/show_bug.cgi?id=484320	CVE	Patch
http://secunia.com/advisories/34471	CVE	Vendor Advisory
http://secunia.com/advisories/34505	CVE	Vendor Advisory
http://secunia.com/advisories/34510	CVE	Vendor Advisory
http://secunia.com/advisories/34511	CVE	Vendor Advisory
http://secunia.com/advisories/34521	CVE	Vendor Advisory
http://secunia.com/advisories/34527	CVE	Vendor Advisory
http://secunia.com/advisories/34549	CVE	Vendor Advisory
http://secunia.com/advisories/34550	CVE	Vendor Advisory
http://secunia.com/advisories/34792	CVE	Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11368	CVE
http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm	CVE
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01023.html	CVE
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01040.html	CVE
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html	CVE
http://twitter.com/tippingpoint1/status/1351635812	CVE
http://www.debian.org/security/2009/dsa-1756	CVE
http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889	CVE
http://www.mandriva.com/security/advisories?name=MDVSA-2009:084	CVE
http://www.mozilla.org/security/announce/2009/mfsa2009-13.html	CVE	PatchVendor Advisory
http://www.redhat.com/support/errata/RHSA-2009-0397.html	CVE
http://www.redhat.com/support/errata/RHSA-2009-0398.html	CVE
http://www.securityfocus.com/archive/1/502303/100/0/threaded	CVE
http://www.securityfocus.com/bid/34181	CVE	Patch
http://www.securitytracker.com/id?1021878	CVE
http://www.ubuntu.com/usn/usn-745-1	CVE
http://www.vupen.com/english/advisories/2009/0864	CVE	PatchVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-09-015	CVE
http://blogs.zdnet.com/security/?p=2934	[email protected]
http://blogs.zdnet.com/security/?p=2941	[email protected]
http://cansecwest.com/index.html	[email protected]
http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009	[email protected]
http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html	[email protected]
http://news.cnet.com/8301-1009_3-10199652-83.html	[email protected]
http://osvdb.org/52896	[email protected]
https://bugzilla.mozilla.org/show_bug.cgi?id=484320	[email protected]	Patch
http://secunia.com/advisories/34471	[email protected]	Vendor Advisory
http://secunia.com/advisories/34505	[email protected]	Vendor Advisory
http://secunia.com/advisories/34510	[email protected]	Vendor Advisory
http://secunia.com/advisories/34511	[email protected]	Vendor Advisory
http://secunia.com/advisories/34521	[email protected]	Vendor Advisory
http://secunia.com/advisories/34527	[email protected]	Vendor Advisory
http://secunia.com/advisories/34549	[email protected]	Vendor Advisory
http://secunia.com/advisories/34550	[email protected]	Vendor Advisory
http://secunia.com/advisories/34792	[email protected]	Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11368	[email protected]
http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm	[email protected]
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01023.html	[email protected]
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01040.html	[email protected]
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html	[email protected]
http://twitter.com/tippingpoint1/status/1351635812	[email protected]
http://www.debian.org/security/2009/dsa-1756	[email protected]
http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889	[email protected]
http://www.mandriva.com/security/advisories?name=MDVSA-2009:084	[email protected]
http://www.mozilla.org/security/announce/2009/mfsa2009-13.html	[email protected]	PatchVendor Advisory
http://www.redhat.com/support/errata/RHSA-2009-0397.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2009-0398.html	[email protected]
http://www.securityfocus.com/archive/1/502303/100/0/threaded	[email protected]
http://www.securityfocus.com/bid/34181	[email protected]	Patch
http://www.securitytracker.com/id?1021878	[email protected]
http://www.ubuntu.com/usn/usn-745-1	[email protected]
http://www.vupen.com/english/advisories/2009/0864	[email protected]	PatchVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-09-015	[email protected]

see all 72 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-399	Resource Management Errors	[email protected]

Affected Products

Product	Versions
mozilla firefox	3.0.7
CPE cpe:2.3:a:mozilla:firefox:3.0.7:::::::* Remediation No remediation found in references.
microsoft windows 7	All versions
CPE cpe:2.3:o:microsoft:windows_7:::::::: Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Oct 10, 2018	CVE Modified	[email protected]
Sep 29, 2017	CVE Modified	[email protected]
Mar 23, 2009	Initial Analysis	[email protected]