p PatchFirst

CVE-2009-2404

CVE-2009-2404

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.

EPSS 4.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • nss Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.12.3-1

    Update to 3.12.3-1

  • nss Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.12.3-1

    Update to 3.12.3-1

  • nss Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.12.3-1

    Update to 3.12.3-1

Original sources

Check your server →