CVE-2009-2404

N/A

Published: August 3, 2009 at 02:00 PM UTC

Updated: June 16, 2026 at 11:09 PM UTC

4 products affected across 1 vendorNetwork Security ServicesFirefoxThunderbird· also runs on 3 platforms

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 4%

Description

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Network Security Services · Mozilla

95%

3.12.3

aol-instant-messenger (environment) · gnome-evolution (environment) · mozilla-firefox (environment) · mozilla-seamonkey (environment) · mozilla-thunderbird (environment) · pidgin-pidgin (environment)

Firefox · Mozilladevice

80%

All versions

Seamonkey · Mozilladevice

80%

All versions

Thunderbird · Mozilladevice

80%

All versions