CVE-2009-0774: Mozilla Firefox

High severity, CVSS 9.3. EPSS: 4% chance of exploitation in the next 30 days.

The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to gczeal, a different vulnerability than CVE-2009-0773.

Affected products

• Mozilla Firefox: up to and including 3.0.6; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; …
• Mozilla Seamonkey: up to and including 1.1.14; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.5 only; …
• Mozilla Thunderbird: up to and including 2.0.0.20; version 2.0.0.0 only; version 2.0.0.4 only; version 2.0.0.5 only; version 2.0.0.6 only; version 2.0.0.9 only; …

Published 2009-03-05. Last modified 2026-06-16.