Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Libsystem | — | Apply OS X security update 2010-002Upgrade macOS to the latest version | Dec 16, 2011 | Jul 1, 2009 |
| Centos_linux | — | Upgrade php-xmlrpcUpgrade kdelibsUpgrade php-pdoUpgrade phpUpgrade thunderbirdUpgrade php-ncursesUpgrade php-develUpgrade php-dbaUpgrade php-ldapUpgrade kdelibs-develUpgrade php-bcmathUpgrade php-imapUpgrade php-gdUpgrade php-snmpUpgrade php-mysqlUpgrade php-mbstringUpgrade php-cliUpgrade kdelibs-apidocsUpgrade php-pgsqlUpgrade php-commonUpgrade php-xmlUpgrade php-odbcUpgrade php-soap | Dec 1, 2016 | Jul 1, 2009 |
| Debian | — | Upgrade monoUpgrade nspr | Mar 31, 2017 | Jul 1, 2009 |
| Freebsd | — | Upgrade seamonkeyUpgrade operaUpgrade monoUpgrade linux-operaUpgrade thunderbirdUpgrade linux-thunderbirdUpgrade linux-seamonkey | Dec 10, 2025 | Dec 1, 2009 |
| Mfsa2009 59 | — | Upgrade to Mozilla Firefox version 3.0.15Upgrade to Mozilla Firefox version 3.5.4 | Jun 14, 2012 | Jul 1, 2009 |
| Oracle_linux | — | Upgrade php-xmlrpcUpgrade php-develUpgrade phpUpgrade php-gdUpgrade php-ldapUpgrade php-ncursesUpgrade php-pgsqlUpgrade php-dbaUpgrade php-soapUpgrade php-pdoUpgrade kdelibs-develUpgrade php-bcmathUpgrade php-commonUpgrade php-snmpUpgrade kdelibs-apidocsUpgrade php-imapUpgrade php-xmlUpgrade php-mysqlUpgrade php-mbstringUpgrade kdelibsUpgrade php-cliUpgrade php-odbc | Oct 16, 2024 | Jul 1, 2009 |
| Suse | — | Upgrade MozillaThunderbird-translationsUpgrade mozilla-xulrunner191-develUpgrade kdelibs3Upgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade kdelibs4-coreUpgrade libkdecore4-develUpgrade seamonkeyUpgrade utempter-32bitUpgrade mozilla-nspr-develUpgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade mozilla-xulrunner190-develUpgrade utempter-64bitUpgrade mozilla-xulrunner191Upgrade seamonkey-dom-inspectorUpgrade utempterUpgrade mozilla-xulrunner190-32bitUpgrade kdelibs3-default-styleUpgrade mozilla-venkmanUpgrade mozilla-nspr-x86Upgrade MozillaFirefox-translationsUpgrade kdelibs3-artsUpgrade libkdecore4-x86Upgrade mozilla-develUpgrade kdelibs3-64bitUpgrade libkdecore4-64bitUpgrade mozilla-nspr-32bitUpgrade mozilla-ircUpgrade ruby-examplesUpgrade kdelibs4-branding-upstreamUpgrade mozilla-xulrunner190-translationsUpgrade rubyUpgrade kdelibs3-default-style-32bitUpgrade mozilla-nsprUpgrade mozillathunderbirdUpgrade ruby-doc-htmlUpgrade seamonkey-ircUpgrade mozilla-dom-inspectorUpgrade libkde4-64bitUpgrade mozilla-xulrunner190-64bitUpgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-xulrunner190Upgrade kdelibs4Upgrade kdelibs3-arts-x86Upgrade mozillafirefox-branding-upstreamUpgrade python-xpcom191Upgrade libkde4-32bitUpgrade seamonkey-mailUpgrade ruby-tkUpgrade mozilla-xulrunner190-translations-64bitUpgrade mozillaUpgrade mozillafirefoxUpgrade utempter-x86Upgrade mozilla-xulrunner191-translationsUpgrade kdelibs3-docUpgrade ruby-develUpgrade kdelibs3-arts-32bitUpgrade mozilla-xulrunner191-gnomevfs-32bitUpgrade libkdecore4-32bitUpgrade mozilla-mailUpgrade kdelibs3-devel-docUpgrade mozilla-xulrunner190-translations-32bitUpgrade kdelibs3-arts-64bitUpgrade mozilla-xulrunner191-32bitUpgrade seamonkey-venkmanUpgrade kdelibs3-x86Upgrade kdelibs4-docUpgrade libkde4Upgrade mozilla-xulrunner191-translations-32bitUpgrade ruby-test-suiteUpgrade operaUpgrade python-xpcom190Upgrade mozilla-nspr-64bitUpgrade mozilla-xulrunner190-gnomevfsUpgrade kdelibs3-32bitUpgrade libkdecore4Upgrade kdelibs3-default-style-64bitUpgrade kdelibs3-develUpgrade libkde4-x86Upgrade sle-sdk-releaseUpgrade libkde4-develUpgrade ruby-doc-riUpgrade MozillaThunderbird-develUpgrade seamonkey-spellchecker | Feb 17, 2015 | Jul 1, 2009 |
| Ubuntu | — | Upgrade kdelibs4c2aUpgrade thunderbird | Nov 8, 2024 | Jul 1, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub