What’s Vulnerable › Vulnerabilities

CVE-2009-2404

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-08-03 · updated 2026-06-16
• Weakness: CWE-119

Description

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.

Affected products

• Mozilla Network Security Services: 3.12.3

References

• http://rhn.redhat.com/errata/RHSA-2009-1185.html
• http://secunia.com/advisories/36088
• http://secunia.com/advisories/36102
• http://secunia.com/advisories/36125
• http://secunia.com/advisories/36139
• http://secunia.com/advisories/36157
• http://secunia.com/advisories/36434
• http://secunia.com/advisories/37098
• http://secunia.com/advisories/39428
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-273910-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021030.1-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021699.1-1

Get alerted when CVE-2009-2404 or the next vulnerability affects your stack