Description
Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid "Client Master Key" length values.
Metrics
CVSS 2.0 6.8/10
AV:N/AC:M/Au:N/C:P/I:P/A:PWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://fedoranews.org/cms/node/2709Broken Link
- http://fedoranews.org/cms/node/2711Broken Link
- http://fedoranews.org/cms/node/2747Broken Link
- http://fedoranews.org/cms/node/2749Broken Link
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Broken Link
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483Broken Link
- http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.htmlBroken Link
- http://rhn.redhat.com/errata/RHSA-2007-0077.htmlThird Party Advisory
- http://secunia.com/advisories/24253Third Party Advisory
- http://secunia.com/advisories/24277Third Party Advisory
- http://secunia.com/advisories/24287Third Party Advisory
- http://secunia.com/advisories/24290Third Party Advisory
- http://secunia.com/advisories/24293Third Party Advisory
- http://secunia.com/advisories/24333Third Party Advisory
- http://secunia.com/advisories/24342Third Party Advisory
- http://secunia.com/advisories/24343Third Party Advisory
- http://secunia.com/advisories/24384Third Party Advisory
- http://secunia.com/advisories/24389Third Party Advisory
- http://secunia.com/advisories/24395Third Party Advisory
- http://secunia.com/advisories/24406Third Party Advisory
- http://secunia.com/advisories/24410Third Party Advisory
- http://secunia.com/advisories/24455Third Party Advisory
- http://secunia.com/advisories/24456Third Party Advisory
- http://secunia.com/advisories/24457Third Party Advisory
- http://secunia.com/advisories/24522Third Party Advisory
- http://secunia.com/advisories/24562Third Party Advisory
- http://secunia.com/advisories/24650Third Party Advisory
- http://secunia.com/advisories/24703Third Party Advisory
- http://secunia.com/advisories/25588Third Party Advisory
- http://secunia.com/advisories/25597Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200703-18.xmlThird Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131Mailing List, Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947Mailing List, Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851Mailing List, Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1Broken Link
- http://www.debian.org/security/2007/dsa-1336Third Party Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200703-22.xmlThird Party Advisory
- http://www.kb.cert.org/vuls/id/592796Third Party Advisory, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:050Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:052Third Party Advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-06.htmlVendor Advisory
- http://www.novell.com/linux/security/advisories/2007_22_mozilla.htmlBroken Link
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlThird Party Advisory
- http://www.osvdb.org/32106Broken Link
- http://www.redhat.com/support/errata/RHSA-2007-0078.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0079.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0097.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0108.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/461336/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/461809/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/64758Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1017696Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-428-1Third Party Advisory
- http://www.ubuntu.com/usn/usn-431-1Third Party Advisory
- http://www.vupen.com/english/advisories/2007/0718Third Party Advisory
- http://www.vupen.com/english/advisories/2007/0719Third Party Advisory
- http://www.vupen.com/english/advisories/2007/1165Third Party Advisory
- http://www.vupen.com/english/advisories/2007/2141Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=364323Issue Tracking, Vendor Advisory
Timeline
- Published
- Feb 26, 2007
- Last modified
- Jun 16, 2026
- NVD status
- Modified