CVE-2009-2465

no score yetEPSS 5.4%

Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via vectors involving double frame construction, related to (1) nsHTMLContentSink.cpp, (2) nsXMLContentSink.cpp, and (3) nsPresShell.cpp, and the nsSubDocumentFrame::Reflow function.

EPSS: 5.4% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-399
Published: 2009-07-22
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox
mozilla:thunderbird

References

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html
http://rhn.redhat.com/errata/RHSA-2009-1162.html
http://secunia.com/advisories/35914
http://secunia.com/advisories/35943

Check your stack JSON