vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2009-2409

N/A
Published: July 30, 2009 at 07:00 PM UTC
Updated: June 16, 2026 at 11:09 PM UTC
3 products affected across 3 vendorsOpenSSLGnutlsNetwork Security Services

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 4%

Description

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Gnutls· Gnu
95%
v < 2.6.42.7.0 ≤ v < 2.7.4
Affected range stops below 2.6.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.7.4, so it looks safe — our inference, not a vendor statement
Network Security Services· Mozilla
95%
v < 3.12.3
Affected range stops below 3.12.3, so it looks safe — our inference, not a vendor statement
OpenSSL· OpenSSL
95%
0.9.8 ≤ v ≤ 0.9.8k

References (37)

x_refsource_CONFIRMPatch
Source: [email protected]
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html
x_refsource_CONFIRMRelease Notes
Source: [email protected]
http://java.sun.com/javase/6/webnotes/6u17.html
Vendor Advisoryx_refsource_APPLE
Source: [email protected]
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/36139
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/36157
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/36434
Third Party Advisoryx_refsource_SECUNIANot Applicable
Source: [email protected]
http://secunia.com/advisories/36669
Third Party Advisoryx_refsource_SECUNIANot Applicable
Source: [email protected]
http://secunia.com/advisories/36739

CVSS

5.1MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-295

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card