Mozilla Network Security Services (NSS) SSLv2 buffer overflows — Mozilla

2007-02-2300:00:00

Mozilla Foundation

www.mozilla.org

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.969

Percentile

99.7%

JSON

iDefense has informed Mozilla about two potential buffer overflow vulnerabilities found by researcher regenrecht in the Network Security Services (NSS) code for processing the SSLv2 protocol.

Affected configurations

Vulners

Node

mozillafirefoxRange<1.5.0.10

mozillafirefoxRange<2.0.0.2

mozillanssRange<3.11.5

mozillaseamonkeyRange<1.0.8

mozillathunderbirdRange<1.5.0.10

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillanss*cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:*
mozillaseamonkey*cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
mozillathunderbird*cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	nss	*	cpe:2.3:a:mozilla:nss::::::::
mozilla	seamonkey	*	cpe:2.3:a:mozilla:seamonkey::::::::
mozilla	thunderbird	*	cpe:2.3:a:mozilla:thunderbird::::::::