CVE-2007-0008

Published: Feb 26, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow.

Affected (86)

Products: Mozilla: Firefox, Network Security Services, Seamonkey, Thunderbird

Mozilla

4 products

Firefox

Network Security Services

Seamonkey

Thunderbird

Configuration A

86 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 1.5.0.9
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.1
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.3
Mozilla Firefox	Version 0.4
Mozilla Firefox	Version 0.5
Mozilla Firefox	Version 0.6.1
Mozilla Firefox	Version 0.6
Mozilla Firefox	Version 0.7.1
Mozilla Firefox	Version 0.7
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.0 preview_release
Mozilla Firefox	Version 1.4.1
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0
Mozilla Network Security Services	Version 3.11.2
Mozilla Network Security Services	Version 3.11.3
Mozilla Network Security Services	Version 3.11.4
Mozilla Seamonkey	Up to 1.0.7
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0
Mozilla Thunderbird	Up to 1.5.0.9
Mozilla Thunderbird	Version 0.1
Mozilla Thunderbird	Version 0.2
Mozilla Thunderbird	Version 0.3
Mozilla Thunderbird	Version 0.4
Mozilla Thunderbird	Version 0.5
Mozilla Thunderbird	Version 0.6
Mozilla Thunderbird	Version 0.7.1
Mozilla Thunderbird	Version 0.7.2
Mozilla Thunderbird	Version 0.7.3
Mozilla Thunderbird	Version 0.7
Mozilla Thunderbird	Version 0.8
Mozilla Thunderbird	Version 0.9
Mozilla Thunderbird	Version 1.0.1
Mozilla Thunderbird	Version 1.0.2
Mozilla Thunderbird	Version 1.0.3
Mozilla Thunderbird	Version 1.0.4
Mozilla Thunderbird	Version 1.0.5
Mozilla Thunderbird	Version 1.0.6
Mozilla Thunderbird	Version 1.0.7
Mozilla Thunderbird	Version 1.0.8
Mozilla Thunderbird	Version 1.0
Mozilla Thunderbird	Version 1.5.0.1
Mozilla Thunderbird	Version 1.5.0.2
Mozilla Thunderbird	Version 1.5.0.3
Mozilla Thunderbird	Version 1.5.0.4
Mozilla Thunderbird	Version 1.5.0.5
Mozilla Thunderbird	Version 1.5.0.6
Mozilla Thunderbird	Version 1.5.0.7
Mozilla Thunderbird	Version 1.5.0.8
Mozilla Thunderbird	Version 1.5
Mozilla Thunderbird	Version 1.5 beta2

Related CWEs

CWE-189

References (148)

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2709

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2711

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2713

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2728

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2747

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2749

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: secalert@redhat.com

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482

Source: secalert@redhat.com

Vendor Advisory

http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2007-0077.html

Source: secalert@redhat.com

http://secunia.com/advisories/24205

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24238

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24252

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24253

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24277

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24287

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24290

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24293

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24320

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24328

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24333

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24342

Source: secalert@redhat.com

http://secunia.com/advisories/24343

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24384

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24389

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24395

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24406

Source: secalert@redhat.com

http://secunia.com/advisories/24410

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24455

Source: secalert@redhat.com

http://secunia.com/advisories/24456

Source: secalert@redhat.com

http://secunia.com/advisories/24457

Source: secalert@redhat.com

http://secunia.com/advisories/24522

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24562

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24650

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/24703

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25588

Source: secalert@redhat.com

http://secunia.com/advisories/25597

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200703-18.xml

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1

Source: secalert@redhat.com

http://www.debian.org/security/2007/dsa-1336

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200703-22.xml

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/377812

Source: secalert@redhat.com

US Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2007:050

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2007:052

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2007/mfsa2007-06.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.novell.com/linux/security/advisories/2007_22_mozilla.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Source: secalert@redhat.com

http://www.osvdb.org/32105

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0078.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0079.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0097.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0108.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/461336/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/461809/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/22694

Source: secalert@redhat.com

http://www.securityfocus.com/bid/64758

Source: secalert@redhat.com

http://www.securitytracker.com/id?1017696

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-428-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-431-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/0718

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/0719

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/1165

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2141

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=364319

Source: secalert@redhat.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/32666

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1081

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1103

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10502

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)