Read the docs
TI-2009-02294 Aliases CVE-2009-2404GHSA-9w79-fpqx-hcfm

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security…

Priority MEDIUM 47CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.

Why it matters now

EPSS 0.04155 90th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:network_security_services:3.12.3:*:*:*:*:*:*:*3.12.3VulnerableMozilla
cpe:2.3:a:aol:instant_messenger:*:*:*:*:*:*:*:*all versionsRunning onAOL
cpe:2.3:a:gnome:evolution:*:*:*:*:*:*:*:*all versionsRunning onGNOME
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*all versionsRunning onMozilla
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*all versionsRunning onMozilla
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*all versionsRunning onMozilla
cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:*all versionsRunning onPidgin
  • cpe:2.3:a:mozilla:network_security_services:3.12.3:*:*:*:*:*:*:* Versions 3.12.3 Vulnerable ·Mozilla
  • cpe:2.3:a:aol:instant_messenger:*:*:*:*:*:*:*:* Versions all versions Running on ·AOL
  • cpe:2.3:a:gnome:evolution:*:*:*:*:*:*:*:* Versions all versions Running on ·GNOME
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions all versions Running on ·Mozilla
  • cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* Versions all versions Running on ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions all versions Running on ·Mozilla
  • cpe:2.3:a:pidgin:pidgin:*:*:*:*:*:*:*:* Versions all versions Running on ·Pidgin

Remediation

Red Hat 5 advisories

  • RHSA-2009:1207 Released 2009-08-12 · Red Hat rating Critical
    nspr and nss security update
    • Red Hat Enterprise Linux EUS (v. 5.2 server) nspr-4.7.4-1.el5_2, nspr-4.7.4-1.el5_2.i386, nspr-4.7.4-1.el5_2.ia64 +21
  • RHSA-2009:1190 Released 2009-07-31 · Red Hat rating Critical
    nspr and nss security and bug fix update
    • Red Hat Enterprise Linux AS EUS (v. 4.7) nspr-4.7.4-1.el4_7.1, nspr-4.7.4-1.el4_7.1.i386, nspr-4.7.4-1.el4_7.1.ia64 +13
    • Red Hat Enterprise Linux ES EUS (v. 4.7) nspr-4.7.4-1.el4_7.1, nspr-4.7.4-1.el4_7.1.i386, nspr-4.7.4-1.el4_7.1.ia64 +9
  • RHSA-2009:1186 Released 2009-07-30 · Red Hat rating Critical
    nspr and nss security, bug fix, and enhancement update
    • Red Hat Enterprise Linux (v. 5 server) nspr-4.7.4-1.el5_3.1, nspr-4.7.4-1.el5_3.1.i386, nspr-4.7.4-1.el5_3.1.ia64 +21
    • Red Hat Enterprise Linux Desktop (v. 5 client) nspr-4.7.4-1.el5_3.1, nspr-4.7.4-1.el5_3.1.i386, nss-3.12.3.99.3-1.el5_3.2 +3
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nspr-4.7.4-1.el5_3.1, nspr-devel-4.7.4-1.el5_3.1, nspr-devel-4.7.4-1.el5_3.1.i386 +5
Show 2 more Red Hat advisories
  • RHSA-2009:1185 Released 2009-07-30 · Red Hat rating Critical
    seamonkey security update
    • Red Hat Desktop version 3 seamonkey-1.0.9-0.41.el3, seamonkey-1.0.9-0.41.el3.i386, seamonkey-chat-1.0.9-0.41.el3 +17
    • Red Hat Enterprise Linux AS version 3 seamonkey-1.0.9-0.41.el3, seamonkey-1.0.9-0.41.el3.i386, seamonkey-1.0.9-0.41.el3.ia64 +37
    • Red Hat Enterprise Linux ES version 3 seamonkey-1.0.9-0.41.el3, seamonkey-1.0.9-0.41.el3.i386, seamonkey-1.0.9-0.41.el3.ia64 +27
    • Red Hat Enterprise Linux WS version 3 seamonkey-1.0.9-0.41.el3, seamonkey-1.0.9-0.41.el3.i386, seamonkey-1.0.9-0.41.el3.ia64 +27
  • RHSA-2009:1184 Released 2009-07-30 · Red Hat rating Critical
    nspr and nss security and bug fix update
    • Red Hat Enterprise Linux AS version 4 nspr-4.7.4-1.el4_8.1, nspr-4.7.4-1.el4_8.1.i386, nspr-4.7.4-1.el4_8.1.ia64 +17
    • Red Hat Enterprise Linux Desktop version 4 nspr-4.7.4-1.el4_8.1, nspr-4.7.4-1.el4_8.1.i386, nspr-devel-4.7.4-1.el4_8.1 +7
    • Red Hat Enterprise Linux ES version 4 nspr-4.7.4-1.el4_8.1, nspr-4.7.4-1.el4_8.1.i386, nspr-4.7.4-1.el4_8.1.ia64 +12
    • Red Hat Enterprise Linux WS version 4 nspr-4.7.4-1.el4_8.1, nspr-4.7.4-1.el4_8.1.i386, nspr-4.7.4-1.el4_8.1.ia64 +12

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2009:1185
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1186
Red Hat Enterprise Linux AS EUS (v. 4.7)Fixed RHSA-2009:1190
Red Hat Enterprise Linux AS version 3Fixed RHSA-2009:1185
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:1184
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1186
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:1186
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:1184
Red Hat Enterprise Linux ES EUS (v. 4.7)Fixed RHSA-2009:1190
Red Hat Enterprise Linux ES version 3Fixed RHSA-2009:1185
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:1184
Red Hat Enterprise Linux EUS (v. 5.2 server)Fixed RHSA-2009:1207
Red Hat Enterprise Linux WS version 3Fixed RHSA-2009:1185
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:1184

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2404
  2. 2026-10-03 Alias added: GHSA-9w79-fpqx-hcfm

References

Patch 2

Advisory 12

Other 5

  • TI-2015-03381 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server… CVSS 3.1LOW 3.7
  • TI-2007-00009 Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services… CVSS 2.0MEDIUM 6.8
  • TI-2018-08903 A cached side channel attack during handshakes using RSA encryption could allow for the… CVSS 3.0MEDIUM 5.9
  • TI-2015-05957 Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services… CVSS 3.0CRITICAL 9.8
  • TI-2004-00763 Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows… CVSS 2.0HIGH 7.5
  • TI-2014-01197 Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in… CVSS 2.0HIGH 10.0
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences