製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Mozilla 製品の HTML パーサにおける任意のコードを実行される脆弱性

Title	複数の Mozilla 製品の HTML パーサにおける任意のコードを実行される脆弱性
Summary	複数の Mozilla 製品の HTML パーサには、任意のコードを実行される脆弱性が存在します。
Possible impacts	低メモリ状態で開放されたオブジェクトへのアクセスを試行するメソッドの呼び出しを介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 17, 2010, midnight
Registration Date	March 9, 2010, 11:01 a.m.
Last Update	April 1, 2010, 1:51 p.m.

CVSS2.0 : 危険
Score	10
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected System

レッドハット

Red Hat Enterprise Linux 3 (as)

Red Hat Enterprise Linux 3 (es)

Red Hat Enterprise Linux 3 (ws)

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 3.0

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Desktop 5.0 (client)

Red Hat Enterprise Linux EUS 5.4.z (server)

RHEL Desktop Workstation 5 (client)

RHEL Optional Productivity Applications 5 (server)

RHEL Optional Productivity Applications EUS 5.4.z (server)

Mozilla Foundation

Mozilla Firefox 3.0.18 未満

Mozilla Firefox 3.5.8 未満

Mozilla SeaMonkey 2.0.3 未満

Mozilla Thunderbird 3.0.2 未満

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 3.0

Asianux Server 3.0 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-1571	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1571
National Vulnerability Database (NVD)
2	CVE-2009-1571	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1571

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-94	https://jvndb.jvn.jp/ja/cwe/CWE-94.html

ベンダー情報

No	Name	URL
Asianux Technical Support Network
1	firefox-3.0.18-1.1.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=983
MIRACLE LINUX アップデート情報
2	2025	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2025
3	2031	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2031
Mozilla Foundation Security Advisory
4	MFSA 2010-03	http://www.mozilla.org/security/announce/2010/mfsa2010-03.html
Mozilla Foundation セキュリティアドバイザリ
5	MFSA 2010-03	http://www.mozilla-japan.org/security/announce/2010/mfsa2010-03.html
Red Hat Security Advisory
6	RHSA-2010:0112	https://rhn.redhat.com/errata/RHSA-2010-0112.html
7	RHSA-2010:0113	https://rhn.redhat.com/errata/RHSA-2010-0113.html
8	RHSA-2010:0153	http://rhn.redhat.com/errata/RHSA-2010-0153.html
9	RHSA-2010:0154	http://rhn.redhat.com/errata/RHSA-2010-0154.html

その他

No	Name	URL
ISS X-Force Database
1	56361	http://xforce.iss.net/xforce/xfdb/56361
Secunia Advisory
2	SA37242	http://secunia.com/advisories/37242
SecurityFocus
3	38287	http://www.securityfocus.com/bid/38287
VUPEN Security
4	VUPEN/ADV-2010-0405	http://www.vupen.com/english/advisories/2010/0405

Change Log

No	Changed Details	Date of change
0	[2010年03月09日] 掲載 [2010年04月01日] 影響を受けるシステム：レッドハット (RHSA-2010:0153) の情報を追加ベンダ情報：レッドハット (RHSA-2010:0153) を追加ベンダ情報：レッドハット (RHSA-2010:0154) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2009-1571

Summary	Use-after-free vulnerability in the HTML parser in Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, Thunderbird before 3.0.2, and SeaMonkey before 2.0.3 allows remote attackers to execute arbitrary code via unspecified method calls that attempt to access freed objects in low-memory situations.
Publication Date	Feb. 22, 2010, 10 p.m.
Registration Date	Jan. 29, 2021, 1:17 p.m.
Last Update	Oct. 11, 2018, 4:37 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:mozilla:firefox:3.0:::::::*
cpe:2.3:a:mozilla:firefox:3.0:alpha::::::
cpe:2.3:a:mozilla:firefox:3.0:beta2::::::
cpe:2.3:a:mozilla:firefox:3.0:beta5::::::
cpe:2.3:a:mozilla:firefox:3.0.1:::::::*
cpe:2.3:a:mozilla:firefox:3.0.2:::::::*
cpe:2.3:a:mozilla:firefox:3.0.3:::::::*
cpe:2.3:a:mozilla:firefox:3.0.4:::::::*
cpe:2.3:a:mozilla:firefox:3.0.5:::::::*
cpe:2.3:a:mozilla:firefox:3.0.6:::::::*
cpe:2.3:a:mozilla:firefox:3.0.7:::::::*
cpe:2.3:a:mozilla:firefox:3.0.8:::::::*
cpe:2.3:a:mozilla:firefox:3.0.9:::::::*
cpe:2.3:a:mozilla:firefox:3.0.10:::::::*
cpe:2.3:a:mozilla:firefox:3.0.11:::::::*
cpe:2.3:a:mozilla:firefox:3.0.12:::::::*
cpe:2.3:a:mozilla:firefox:3.0.13:::::::*
cpe:2.3:a:mozilla:firefox:3.0.14:::::::*
cpe:2.3:a:mozilla:firefox:3.0.15:::::::*
cpe:2.3:a:mozilla:firefox:3.0.17:::::::*
cpe:2.3:a:mozilla:firefox:3.5:::::::*
cpe:2.3:a:mozilla:firefox:3.5.1:::::::*
cpe:2.3:a:mozilla:firefox:3.5.2:::::::*
cpe:2.3:a:mozilla:firefox:3.5.3:::::::*
cpe:2.3:a:mozilla:firefox:3.5.4:::::::*
cpe:2.3:a:mozilla:firefox:3.5.5:::::::*
cpe:2.3:a:mozilla:firefox:3.5.6:::::::*
cpe:2.3:a:mozilla:firefox:3.5.7:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0:alpha::::::
cpe:2.3:a:mozilla:seamonkey:1.0:beta::::::
cpe:2.3:a:mozilla:seamonkey:1.0.1:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.2:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.3:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.4:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.5:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.6:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.7:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.8:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.9:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.1:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.2:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.3:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.4:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.5:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.6:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.7:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.8:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.9:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.10:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.11:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.12:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.13:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.14:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.15:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.16:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.17:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2::::::
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3::::::
cpe:2.3:a:mozilla:seamonkey:2.0:beta_1::::::
cpe:2.3:a:mozilla:seamonkey:2.0:beta_2::::::
cpe:2.3:a:mozilla:seamonkey:2.0:rc1::::::
cpe:2.3:a:mozilla:seamonkey:2.0:rc2::::::
cpe:2.3:a:mozilla:seamonkey:2.0.1:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.2:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035346.html	FEDORA
2	http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035367.html	FEDORA
3	http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035426.html	FEDORA
4	http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036097.html	FEDORA
5	http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036132.html	FEDORA
6	http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00001.html	SUSE
7	http://secunia.com/advisories/37242	SECUNIA	Vendor Advisory
8	http://secunia.com/advisories/38770	SECUNIA
9	http://secunia.com/advisories/38772	SECUNIA
10	http://secunia.com/advisories/38847	SECUNIA
11	http://secunia.com/secunia_research/2009-45/	MISC	Vendor Advisory
12	http://www.debian.org/security/2010/dsa-1999	DEBIAN
13	http://www.mandriva.com/security/advisories?name=MDVSA-2010:042	MANDRIVA
14	http://www.mandriva.com/security/advisories?name=MDVSA-2010:051	MANDRIVA
15	http://www.mozilla.org/security/announce/2010/mfsa2010-03.html	CONFIRM	Vendor Advisory
16	http://www.redhat.com/support/errata/RHSA-2010-0112.html	REDHAT
17	http://www.redhat.com/support/errata/RHSA-2010-0113.html	REDHAT
18	http://www.redhat.com/support/errata/RHSA-2010-0153.html	REDHAT
19	http://www.redhat.com/support/errata/RHSA-2010-0154.html	REDHAT
20	http://www.securityfocus.com/archive/1/509585/100/0/threaded	BUGTRAQ
21	http://www.ubuntu.com/usn/USN-895-1	UBUNTU
22	http://www.ubuntu.com/usn/USN-896-1	UBUNTU
23	http://www.vupen.com/english/advisories/2010/0405	VUPEN	Vendor Advisory
24	http://www.vupen.com/english/advisories/2010/0650	VUPEN
25	https://bugzilla.mozilla.org/show_bug.cgi?id=526500	CONFIRM
26	https://exchange.xforce.ibmcloud.com/vulnerabilities/56361	XF
27	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11227	OVAL
28	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8615	OVAL

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-94	コード・インジェクション	https://cwe.mitre.org/data/definitions/94.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:mozilla:firefox:3.0:::::::*
cpe:2.3:a:mozilla:firefox:3.0:alpha::::::
cpe:2.3:a:mozilla:firefox:3.0:beta2::::::
cpe:2.3:a:mozilla:firefox:3.0:beta5::::::
cpe:2.3:a:mozilla:firefox:3.0.1:::::::*
cpe:2.3:a:mozilla:firefox:3.0.2:::::::*
cpe:2.3:a:mozilla:firefox:3.0.3:::::::*
cpe:2.3:a:mozilla:firefox:3.0.4:::::::*
cpe:2.3:a:mozilla:firefox:3.0.5:::::::*
cpe:2.3:a:mozilla:firefox:3.0.6:::::::*
cpe:2.3:a:mozilla:firefox:3.0.7:::::::*
cpe:2.3:a:mozilla:firefox:3.0.8:::::::*
cpe:2.3:a:mozilla:firefox:3.0.9:::::::*
cpe:2.3:a:mozilla:firefox:3.0.10:::::::*
cpe:2.3:a:mozilla:firefox:3.0.11:::::::*
cpe:2.3:a:mozilla:firefox:3.0.12:::::::*
cpe:2.3:a:mozilla:firefox:3.0.13:::::::*
cpe:2.3:a:mozilla:firefox:3.0.14:::::::*
cpe:2.3:a:mozilla:firefox:3.0.15:::::::*
cpe:2.3:a:mozilla:firefox:3.0.17:::::::*
cpe:2.3:a:mozilla:firefox:3.5:::::::*
cpe:2.3:a:mozilla:firefox:3.5.1:::::::*
cpe:2.3:a:mozilla:firefox:3.5.2:::::::*
cpe:2.3:a:mozilla:firefox:3.5.3:::::::*
cpe:2.3:a:mozilla:firefox:3.5.4:::::::*
cpe:2.3:a:mozilla:firefox:3.5.5:::::::*
cpe:2.3:a:mozilla:firefox:3.5.6:::::::*
cpe:2.3:a:mozilla:firefox:3.5.7:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0:alpha::::::
cpe:2.3:a:mozilla:seamonkey:1.0:beta::::::
cpe:2.3:a:mozilla:seamonkey:1.0.1:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.2:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.3:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.4:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.5:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.6:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.7:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.8:::::::*
cpe:2.3:a:mozilla:seamonkey:1.0.9:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.1:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.2:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.3:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.4:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.5:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.6:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.7:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.8:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.9:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.10:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.11:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.12:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.13:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.14:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.15:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.16:::::::*
cpe:2.3:a:mozilla:seamonkey:1.1.17:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2::::::
cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3::::::
cpe:2.3:a:mozilla:seamonkey:2.0:beta_1::::::
cpe:2.3:a:mozilla:seamonkey:2.0:beta_2::::::
cpe:2.3:a:mozilla:seamonkey:2.0:rc1::::::
cpe:2.3:a:mozilla:seamonkey:2.0:rc2::::::
cpe:2.3:a:mozilla:seamonkey:2.0.1:::::::*
cpe:2.3:a:mozilla:seamonkey:2.0.2:::::::*