High severity7.5NVD Advisory· Published Jun 12, 2009· Updated Jun 16, 2026
CVE-2009-1837
CVE-2009-1837
Description
Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free vulnerability for memory associated with a destroyed Java object.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
16cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: >=3.0,<3.0.11
- (no CPE)range: <3.0.11
cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:4.8:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_eus:4.8:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
21- bugzilla.mozilla.org/show_bug.cginvdExploitIssue Tracking
- secunia.com/advisories/34241nvdBroken LinkVendor Advisory
- secunia.com/advisories/35331nvdBroken LinkVendor Advisory
- secunia.com/advisories/35431nvdBroken LinkVendor Advisory
- secunia.com/secunia_research/2009-19/nvdBroken LinkVendor Advisory
- www.debian.org/security/2009/dsa-1820nvdMailing ListThird Party Advisory
- www.mozilla.org/security/announce/2009/mfsa2009-28.htmlnvdVendor Advisory
- www.securityfocus.com/archive/1/504260/100/0/threadednvdBroken LinkThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/35326nvdBroken LinkThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/35360nvdBroken LinkThird Party AdvisoryVDB Entry
- www.securitytracker.com/idnvdBroken LinkThird Party AdvisoryVDB Entry
- www.vupen.com/english/advisories/2009/1572nvdBroken LinkVendor Advisory
- rhn.redhat.com/errata/RHSA-2009-1095.htmlnvdThird Party Advisory
- secunia.com/advisories/35415nvdBroken Link
- secunia.com/advisories/35468nvdBroken Link
- slackware.com/security/viewer.phpnvdBroken Link
- sunsolve.sun.com/search/document.donvdBroken Link
- bugzilla.redhat.com/show_bug.cginvdIssue Tracking
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10628nvdBroken Link
- www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.htmlnvdMailing List
- www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.htmlnvdMailing List
News mentions
0No linked articles in our index yet.