Unscored severity · published Feb 26, 2007
CVE-2007-0008
Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8,…
–
CVSS
4.4%
EPSS
No
On KEV
Description
Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firefox · Mozilla
through 1.5.0.9; 0.1; 0.2; 0.3; 0.4; 0.5; +34 more · source: NVD
NS
Network Security Services · Mozilla
3.11.2; 3.11.3; 3.11.4 · source: NVD
SE
Seamonkey · Mozilla
through 1.0.7; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +2 more · source: NVD
TH
Thunderbird · Mozilla
through 1.5.0.9; 0.1; 0.2; 0.3; 0.4; 0.5; +26 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0008
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0008
fedoranews.org
http://fedoranews.org/cms/node/2709
fedoranews.org
http://fedoranews.org/cms/node/2711
fedoranews.org
http://fedoranews.org/cms/node/2713
fedoranews.org
http://fedoranews.org/cms/node/2728
More from Firefox
10.0
CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
9.8
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
9.8
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
9.6
CVE-2022-26486
Mozilla Firefox Use-After-Free Vulnerability
8.8
CVE-2023-5217
Google Chromium libvpx Heap Buffer Overflow Vulnerability