Bugzilla – Bug 546371
VUL-0: CVE-2009-1563: mozilla-nspr: Array indexing error in NSPR's Balloc()
Last modified: 2021-12-07 16:16:03 UTC
This was reported to Mozilla from Secunia. "We have assigned this vulnerability Secunia advisory SA36711 and CVE identifier CVE-2009-1563." Upstream bugreport is not public yet. --- The vulnerability is caused due to an array indexing error while allocating space for floating point numbers. This can be exploited to trigger a memory corruption via a specially crafted floating point number. Successful exploitation may allow execution of arbitrary code. The vulnerability is confirmed in version 3.0.14 and 3.5.3. Other versions may also be affected. --- The reason seems to be netlib's dtoa.c implementation which is reused in NSPR (and also Mozilla JS engine (which gets fixed together with the next xulrunner update round). As we ship a standalone NSPR we need to fix it there. Fixed upstream version is 4.8.2 which is available. Backport should be possible I think in case it's needed.
Thanks for the notification! Is there a CRD?
The SWAMPID for this issue is 27894. Please submit the patch and patchinfo file using this ID. (https://swamp.suse.de/webswamp/wf/27894)
I can't find a CRD in the Mozilla report therefore I don't think there is one but not absolutely sure.
could someone please submit fixed packages to the older distros? 10.3,11.0,11.1, sle11,sles10sp2,sles10sp3 (the same source should work everywhere I think.)
I will take care of this.
Brian, we also needs this for the current update round (SLE and openSUSE) ,regardless of the product it is currently assigned to. MFSA 2009-59 / CVE-2009-1563: Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code containing a very long string to be converted to a floating point number which would result in improper memory allocation and the execution of an arbitrary memory location. This vulnerability could thus be leveraged by the attacker to run arbitrary code on a victim's computer.
Submitted for SUSE:SLE-11:Update (req id 2542), SUSE:SLE-10-SP3:Update (req id 2543), and SUSE:SLE-10-SP2:Update (req id 2544). Will submit for openSUSE next.
Submitted for openSUSE:11.0:Update (req id 23808) and openSUSE:11.1:Update (req id 23809)
(In reply to comment #4) > could someone please submit fixed packages to the older distros? > > 10.3,11.0,11.1, sle11,sles10sp2,sles10sp3 > > (the same source should work everywhere I think.) Everything should be submitted at this point. openSUSE 10.3 is no longer supported (as of 10/31), so I did not submit packages for it. Marcus informed me of this via IRC.
CVE-2009-1563: CVSS v2 Base Score: 10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Update released for: mozilla-nspr, mozilla-nspr-debuginfo, mozilla-nspr-debugsource, mozilla-nspr-devel Products: openSUSE 11.0 (debug, i386, ppc, ppc64, x86_64) openSUSE 11.1 (debug, i586, ppc, ppc64, x86_64)
Update released for: mozilla-nspr, mozilla-nspr-devel Products: SLE-DESKTOP 10-SP2 (i386, x86_64) SLE-SERVER 10-SP2 (i386, ia64, ppc, s390x, x86_64)
Update released for: mozilla-nspr, mozilla-nspr-32bit, mozilla-nspr-debuginfo, mozilla-nspr-debuginfo-32bit, mozilla-nspr-debuginfo-x86, mozilla-nspr-debugsource, mozilla-nspr-devel, mozilla-nspr-x86 Products: SLE-DEBUGINFO 11 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11 (i386, x86_64) SLE-SDK 11 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11 (i386, ia64, ppc64, s390x, x86_64)
Update released for: mozilla-nspr, mozilla-nspr-32bit, mozilla-nspr-64bit, mozilla-nspr-debuginfo, mozilla-nspr-devel, mozilla-nspr-x86 Products: SLE-DESKTOP 10-SP3 (i386, x86_64) SLE-SERVER 10-SP3 (i386, ia64, ppc, s390x, x86_64)
all done and released but moblin. lets close.
Update released for: mozilla-nspr, mozilla-nspr-debuginfo, mozilla-nspr-debugsource, mozilla-nspr-devel Products: SUSE-MOBLIN 2.0 (i386) SUSE-MOBLIN 2.0-DEBUG (i386)
This is an autogenerated message for OBS integration: This bug (546371) was mentioned in https://build.opensuse.org/request/show/23808 11.0 / mozilla-nspr https://build.opensuse.org/request/show/23809 11.1 / mozilla-nspr