Loading vulnerability…
CVE-2009-0689 is an array-index error in the dtoa and gdtoa floating-point conversion implementations used by libc and multiple operating systems and applications. A large precision value in a printf format argument triggers incorrect memory allocation and a heap-based buffer overflow during floating-point conversion. Affected products include FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, and SeaMonkey 1.1.8. Exploitation can crash the application and may permit arbitrary code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (11 hidden).
This repository implements a browser-based exploit targeting the Nintendo Wii's Internet Channel (Opera-based browser). The exploit leverages a heap manipulation and floating-point parsing vulnerability to achieve arbitrary code execution. The structure includes: - A set of C and assembly files under 'loader/' that build a custom loader binary for the Wii (PowerPC architecture). - 'chain_builder.c' and related scripts ('create.sh', 'multi_tool.c') generate a specially crafted binary chain and payload, which is then packed and converted into a PNG image ('payload.png') for delivery. - The main delivery mechanism is 'index.html', a web page with embedded JavaScript that manipulates the browser's heap via canvas allocations and triggers the vulnerability by parsing a large floating-point number. The payload is loaded as an image and executed after heap grooming. - '.htaccess' files configure the web server to serve the exploit and payload correctly. - The payload is a compressed and packed ELF binary, which is decompressed and executed by the loader on the Wii, enabling arbitrary code execution (such as running homebrew software). The exploit is operational and provides a full chain from browser exploitation to code execution. It is not part of a framework, but is a standalone, multi-stage exploit with custom payload generation and delivery. The main attack vector is via the browser, requiring the victim to visit a malicious web page. The repository is well-structured, with clear separation between exploit chain construction, payload creation, and delivery mechanisms.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An overflow vulnerability triggered by a large precision value in a format string.
A large precision value in a format string triggers an overflow.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.