CVE-2009-2404
Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.
Published:Jul 29, 2009
Last Modified:Apr 23, 2026
EPS:Aug 3, 2009
EPSS Score:0.21024
CVSS Score:9.3
Affected Products
Vendor
Product
Action
Vendor
Aol
Product
Instant Messenger
Aol
Instant Messenger
Vendor
Gnome
Product
Evolution
Gnome
Evolution
Vendor
Mozilla
Product
Firefox
Mozilla
Firefox
Vendor
Mozilla
Product
Network Security Services
Mozilla
Network Security Services
Vendor
Mozilla
Product
Seamonkey
Mozilla
Seamonkey
Vendor
Mozilla
Product
Thunderbird
Mozilla
Thunderbird
Vendor
Pidgin
Product
Pidgin
Pidgin
Pidgin
Vendor
Redhat
Product
Enterprise Linux
Redhat
Enterprise Linux
Vendor
Redhat
Product
Rhel Eus
Redhat
Rhel Eus
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Related CVEs
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
