Skip to content
Fencer Vulns
medium 6.8

CVE-2009-0689 json

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in…

published 2009-07-01 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-0689

cvss
6.8
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
29.4%
EPSS 29.4% chance of exploitation in 30 days, percentile 98%
public exploits
11
Exploit-DB

Summary

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

Patch / fix

  • mono Debian 14, Debian 13, Debian 12 4.2.1.102+dfsg2-4
  • nspr Debian 14, Debian 13, Debian 12 4.8-2

debian advisories DEBIAN-CVE-2009-0689

  • php RHEL 5 5.1.6-44.el5_10
  • php-gd RHEL 5 5.1.6-44.el5_10
  • php-cli RHEL 5 5.1.6-44.el5_10
  • php-dba RHEL 5 5.1.6-44.el5_10
  • php-pdo RHEL 5 5.1.6-44.el5_10
  • php-xml RHEL 5 5.1.6-44.el5_10
  • php-imap RHEL 5 5.1.6-44.el5_10
  • php-ldap RHEL 5 5.1.6-44.el5_10

red hat advisories RHSA-2014:0311RHSA-2010:0154RHSA-2010:0153RHSA-2014:0312RHSA-2009:1601RHSA-2009:1531

  • mono-core SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +2 more 2.6.7-0.18.1
  • mono-core SLES for SAP 11 SP4, SLES for SAP 11 SP3, SLES 11 SP4 +5 more 2.6.7-0.16.1

suse advisories SUSE-SU-2016:2958-1SUSE-SU-2016:0257-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-0689 updated cvss 6.8

array index error in dtoa implementation of many products

  • Red Hat OpenShift Enterprise 1 js Red Hat OpenShift Enterprise 2 js
    affected: no fix available
  • Red Hat Desktop version 3 seamonkey 1.0.9-0.47.el3, seamonkey-nss 1.0.9-0.47.el3, seamonkey-chat 1.0.9-0.47.el3, seamonkey-mail 1.0.9-0.47.el3, seamonkey-nspr 1.0.9-0.47.el3, seamonkey-js-debugger 1.0.9-0.47.el3, +1 more
    fixed: vendor fix RHSA-2009:1531
  • Red Hat Enterprise Linux (v. 5 server) nspr 4.7.6-1.el5_4, php 5.1.6-44.el5_10, firefox 3.0.15-3.el5_4, php-gd 5.1.6-44.el5_10, php-cli 5.1.6-44.el5_10, php-dba 5.1.6-44.el5_10, +18 more
    fixed: vendor fix RHSA-2009:1530
  • Red Hat Enterprise Linux AS version 3 seamonkey 1.0.9-0.47.el3, seamonkey-nss 1.0.9-0.47.el3, seamonkey-chat 1.0.9-0.47.el3, seamonkey-mail 1.0.9-0.47.el3, seamonkey-nspr 1.0.9-0.47.el3, seamonkey-js-debugger 1.0.9-0.47.el3, +1 more Red Hat Enterprise Linux AS version 4 nspr 4.7.6-1.el4_8, firefox 3.0.15-3.el4, kdelibs 3.3.1-17.el4_8.1, seamonkey 1.0.9-50.el4_8, thunderbird 1.5.0.12-25.el4, seamonkey-chat 1.0.9-50.el4_8, +3 more
    fixed: vendor fix RHSA-2009:1531
  • Red Hat Enterprise Linux Desktop (v. 5 client) nspr 4.7.6-1.el5_4, firefox 3.0.15-3.el5_4, kdelibs 3.5.4-25.el5_4.1, xulrunner 1.9.0.15-3.el5_4, thunderbird 2.0.0.24-2.el5_4, kdelibs-apidocs 3.5.4-25.el5_4.1, +1 more
    fixed: vendor fix RHSA-2009:1530
  • Red Hat Enterprise Linux Desktop version 4 nspr 4.7.6-1.el4_8, firefox 3.0.15-3.el4, kdelibs 3.3.1-17.el4_8.1, seamonkey 1.0.9-50.el4_8, thunderbird 1.5.0.12-25.el4, seamonkey-chat 1.0.9-50.el4_8, +3 more
    fixed: vendor fix RHSA-2009:1531
  • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nspr 4.7.6-1.el5_4, php 5.1.6-44.el5_10, php-gd 5.1.6-44.el5_10, php-cli 5.1.6-44.el5_10, php-dba 5.1.6-44.el5_10, php-pdo 5.1.6-44.el5_10, +17 more
    fixed: vendor fix RHSA-2009:1530
  • Red Hat Enterprise Linux ES version 3 seamonkey 1.0.9-0.47.el3, seamonkey-nss 1.0.9-0.47.el3, seamonkey-chat 1.0.9-0.47.el3, seamonkey-mail 1.0.9-0.47.el3, seamonkey-nspr 1.0.9-0.47.el3, seamonkey-js-debugger 1.0.9-0.47.el3, +1 more Red Hat Enterprise Linux ES version 4 nspr 4.7.6-1.el4_8, firefox 3.0.15-3.el4, kdelibs 3.3.1-17.el4_8.1, seamonkey 1.0.9-50.el4_8, thunderbird 1.5.0.12-25.el4, seamonkey-chat 1.0.9-50.el4_8, +3 more
    fixed: vendor fix RHSA-2009:1531
show 3 more
  • Red Hat Enterprise Linux EUS (v. 5.9 server) php 5.1.6-40.el5_9.2, php-gd 5.1.6-40.el5_9.2, php-cli 5.1.6-40.el5_9.2, php-dba 5.1.6-40.el5_9.2, php-pdo 5.1.6-40.el5_9.2, php-xml 5.1.6-40.el5_9.2, +12 more Red Hat Enterprise Linux Long Life (v. 5.3 server) php 5.1.6-23.6.el5_3, php-gd 5.1.6-23.6.el5_3, php-cli 5.1.6-23.6.el5_3, php-dba 5.1.6-23.6.el5_3, php-pdo 5.1.6-23.6.el5_3, php-xml 5.1.6-23.6.el5_3, +12 more Red Hat Enterprise Linux Long Life (v. 5.6 server) php 5.1.6-27.el5_6.7, php-gd 5.1.6-27.el5_6.7, php-cli 5.1.6-27.el5_6.7, php-dba 5.1.6-27.el5_6.7, php-pdo 5.1.6-27.el5_6.7, php-xml 5.1.6-27.el5_6.7, +12 more
    fixed: vendor fix RHSA-2014:0312
  • Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) thunderbird 2.0.0.24-2.el5_4
    fixed: vendor fix RHSA-2010:0153
  • Red Hat Enterprise Linux WS version 3 seamonkey 1.0.9-0.47.el3, seamonkey-nss 1.0.9-0.47.el3, seamonkey-chat 1.0.9-0.47.el3, seamonkey-mail 1.0.9-0.47.el3, seamonkey-nspr 1.0.9-0.47.el3, seamonkey-js-debugger 1.0.9-0.47.el3, +1 more Red Hat Enterprise Linux WS version 4 nspr 4.7.6-1.el4_8, firefox 3.0.15-3.el4, kdelibs 3.3.1-17.el4_8.1, seamonkey 1.0.9-50.el4_8, thunderbird 1.5.0.12-25.el4, seamonkey-chat 1.0.9-50.el4_8, +3 more
    fixed: vendor fix RHSA-2009:1531

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-33058)
  2. Published

Exploit prediction

29.38% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-33480 MATLAB R2009b - 'dtoa' Implementation Memory Corruption dos, 2010-01-08
  • EDB-33479 Apple Mac OSX 10.x - 'libc/strtod(3)' Memory Corruption dos, 2010-01-08
  • EDB-33364 KDE 4.3.3 - KDELibs 'dtoa()' Remote Code Execution remote, 2009-11-20
  • EDB-33363 Opera Web Browser 10.01 - 'dtoa()' Remote Code Execution remote, 2009-11-20
  • EDB-33312 Mozilla Firefox 3.5.3 - Floating Point Conversion Heap Overflow dos, 2009-10-27
  • EDB-33058 BSD (Multiple Distributions) - 'gdtoa/misc.c' Memory Corruption dos, 2009-05-26
  • EDB-10380 Sunbird 0.9 - Array Overrun Code Execution remote, 2009-12-11
  • EDB-10187 Opera 10.01 - Remote Array Overrun dos, 2009-11-19
  • EDB-10186 K-Meleon 1.5.3 - Remote Array Overrun dos, 2009-11-19
  • EDB-10185 SeaMonkey 1.1.8 - Remote Array Overrun dos, 2009-11-19
  • EDB-10184 KDE KDELibs 4.3.3 - Remote Array Overrun dos, 2009-11-19
  • securityfocus.com http://www.securityfocus.com/bid/35510 referenced PoC, tagged "exploit" by a source, unverified
  • securityreason.com http://securityreason.com/achievement_securityalert/63 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.