Unscored severity · published Feb 26, 2007
CVE-2007-0009
Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird…
–
CVSS
50.6%
EPSS
No
On KEV
Description
Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid "Client Master Key" length values.
Exploitation
Is it being used?
Exploit prediction (EPSS)50.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firefox · Mozilla
1.5 before 1.5.0.10; 2.0 before 2.0.0.2 · source: NVD
DL
Debian Linux · Debian
3.1; 4.0 · source: NVD
NS
Network Security Services · Mozilla
before 3.11.5 · source: NVD
SE
Seamonkey · Mozilla
before 1.0.8 · source: NVD
TH
Thunderbird · Mozilla
before 1.5.0.10 · source: NVD
UL
Ubuntu Linux · Canonical
5.10; 6.06; 6.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0009
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0009
Broken Link
http://fedoranews.org/cms/node/2709
Broken Link
http://fedoranews.org/cms/node/2711
Broken Link
http://fedoranews.org/cms/node/2747
Broken Link
http://fedoranews.org/cms/node/2749
More from Firefox
10.0
CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
9.8
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
9.8
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
9.6
CVE-2022-26486
Mozilla Firefox Use-After-Free Vulnerability
8.8
CVE-2023-5217
Google Chromium libvpx Heap Buffer Overflow Vulnerability