CVE-2009-0689K-Meleon Memory Corruption
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x…
Published Jul 1, 2009 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2009-0689, DLA-1564-1, DLA-376-1, DSA-1931-1, DSA-1998-1, SUSE-SU-2016:0257-1, SUSE-SU-2016:2958-1
Key Facts
Routine patching- CVE-2009-0689 is a medium-severity vulnerability (CVSS 6.8 v2) affecting K-Meleon (K-Meleon Project), Firefox (Mozilla), Seamonkey (Mozilla) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 28% probability of exploitation in the next 30 days.
- Fixed versions are available, including bytefx-data-mysql 2.6.7-0.16.1, bytefx-data-mysql 2.6.7-0.18.1, Firefox 0:3.0.15-3.el4.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v2
6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
28%
Higher than 98.0% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
46/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
11
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2009-0689
- advisoryAPPLE-SA-2010-03-29-1
- advisoryRHSA-2009:1530
- advisoryRHSA-2009:1531
- advisoryRHSA-2009:1601
- advisoryRHSA-2010:0153
Description
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.
Affected Products
208 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| K-MeleonK-Meleon Project | 1.5.3 | n/a |
| FirefoxMozilla | 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.2, 3.0.3 | 0:3.0.15-3.el4 |
| SeamonkeyMozilla | 1.1.8 | 0:1.0.9-0.47.el3 |
| FreebsdFreebsd | 6.4, 6.4-release, 6.4-release_p2, 6.4-release_p3, 6.4-release_p4, 6.4-release_p5, 6.4-stable, 7.2 | n/a |
| NetbsdNetbsd | 5.0 | n/a |
Patched Releases
bytefx-data-mysql
2.6.7-0.16.1, 2.6.7-0.18.1
Firefox
0:3.0.15-3.el4, 0:3.0.15-3.el5_4
ibm-data-db2
2.6.7-0.16.1
kdelibs
4:3.5.10.dfsg.1-0lenny4, 6:3.3.1-17.el4_8.1, 6:3.5.4-25.0.1.el5_4.1, 6:3.5.4-25.el5_4.1
kdelibs-apidocs
6:3.5.4-25.0.1.el5_4.1
kdelibs-devel
6:3.5.4-25.0.1.el5_4.1
kdelibs3
3.5.10-89.3
kdelibs3-32bit
3.5.10-89.3
kdelibs3-arts
3.5.10-89.3
kdelibs3-arts-32bit
3.5.10-89.3
kdelibs3-default-style
3.5.10-89.3
kdelibs3-default-style-32bit
3.5.10-89.3
kdelibs3-devel
3.5.10-89.3
kdelibs3-doc
3.5.10-89.3
mono
2.6.7-5.1+deb6u2, 3.2.8+dfsg-10+deb8u1, 4.2.1.102+dfsg2-4
mono-core
2.6.7-0.16.1, 2.6.7-0.18.1
mono-data
2.6.7-0.16.1, 2.6.7-0.18.1
mono-data-firebird
2.6.7-0.16.1, 2.6.7-0.18.1
mono-data-oracle
2.6.7-0.16.1, 2.6.7-0.18.1
mono-data-postgresql
2.6.7-0.16.1, 2.6.7-0.18.1
mono-data-sqlite
2.6.7-0.16.1, 2.6.7-0.18.1
mono-data-sybase
2.6.7-0.16.1, 2.6.7-0.18.1
mono-devel
2.6.7-0.16.1, 2.6.7-0.18.1
mono-extras
2.6.7-0.16.1, 2.6.7-0.18.1
mono-jscript
2.6.7-0.16.1, 2.6.7-0.18.1
Timeline
Publicly disclosed
Jul 1, 2009
Last updated
Aug 4, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- advisorysecurity-tracker.debian.org · CVE-2009-0689
- advisoryAPPLE-SA-2010-03-29-1
- advisoryRHSA-2009:1530
- advisoryRHSA-2009:1531
- advisoryRHSA-2009:1601
FAQ
Common Questions.
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-M…
Affected: K-Meleon (K-Meleon Project) versions 1.5.3; Firefox (Mozilla) versions 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.2, 3.0.3; Seamonkey (Mozilla) versions 1.1.8, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including bytefx-data-mysql 2.6.7-0.16.1, bytefx-data-mysql 2.6.7-0.18.1, Firefox 0:3.0.15-3.el4.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2009-0689 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo