CVE-2009-2404 Memory corruption in n/a

What is CVE-2009-2404?

CVE-2009-2404 is a critical memory corruption vulnerability in Mozilla Network Security Services, published on 3 Aug 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.

Weakness: CWE-119

Which versions are affected by CVE-2009-2404?

It affects 1 product.

Products include Mozilla Network Security Services.

How do I fix CVE-2009-2404?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2009-2404 being exploited?

There is no known exploitation of CVE-2009-2404 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Network Security Services

• CVE-2019-17006 Memory corruption in NSS Critical 9.8
• CVE-2017-5461 Memory corruption in Firefox Critical 9.8
• CVE-2017-11695 Memory corruption in n/a High 7.8
• CVE-2017-11696 Memory corruption in n/a High 7.8
• CVE-2017-11697 Denial of service in n/a High 7.8

All Mozilla Network Security Services vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2009-2404, GHSA-9w79-fpqx-hcfm, RHSA-2009:1185.