CVE-2009-2935

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Google V8, as used in Google Chrome before 2.0.172.43, allows remote attackers to bypass intended restrictions on reading memory, and possibly obtain sensitive information or execute arbitrary code in the Chrome sandbox, via crafted JavaScript.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://code.google.com/p/chromium/issues/detail?id=18639Vendor Advisory
http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.htmlVendor Advisory
http://osvdb.org/57421
http://secunia.com/advisories/36417Vendor Advisory
http://www.securityfocus.com/bid/36149
http://www.securitytracker.com/id?1022773
http://www.vupen.com/english/advisories/2009/2420Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52902
http://code.google.com/p/chromium/issues/detail?id=18639Vendor Advisory
http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.htmlVendor Advisory
http://osvdb.org/57421
http://secunia.com/advisories/36417Vendor Advisory
http://www.securityfocus.com/bid/36149
http://www.securitytracker.com/id?1022773
http://www.vupen.com/english/advisories/2009/2420Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/52902

Timeline

Published: Aug 27, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-29367.5The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before CVE-2009-29374.3Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via t CVE-2009-29396.9The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/post CVE-2009-29407.5The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers t CVE-2009-29427.5The mysql-ocaml bindings 1.0.4 for MySQL do not properly support the mysql_real_escape_string function, which might allow remote attackers t CVE-2009-29437.5The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which m CVE-2009-29445.0Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers CVE-2009-29454.3weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certa CVE-2009-29469.3Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via cr CVE-2009-29474.3Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via un CVE-2009-29481.9mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8 and 3.4 before 3.4.2, when mount.cifs is installed suid root, doe CVE-2009-29499.3Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in OpenOffice.org (OOo) before 3.2 allows remote atta