Read the docs
TI-2009-02298 Aliases CVE-2009-2408GHSA-pm7c-vg9h-jxxc

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird…

Priority LOW 35CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-295.

Summary

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Why it matters now

EPSS 0.05741 93rd percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*before 3.0.13VulnerableMozilla
cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*before 3.12.3VulnerableMozilla
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*before 1.1.18VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*before 2.0.0.23VulnerableMozilla
cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*10.3 – 11.1VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:*10.0VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*11.0VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*9VulnerableSUSE
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*5.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*8.04VulnerableCanonical
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions before 3.0.13 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:* Versions before 3.12.3 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* Versions before 1.1.18 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 2.0.0.23 Vulnerable ·Mozilla
  • cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:* Versions 10.3 – 11.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:* Versions 10.0 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:* Versions 11.0 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·SUSE
  • cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* Versions 8.04 Vulnerable ·Canonical
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*8.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*9.04VulnerableCanonical
  • cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical

Remediation

Red Hat 5 advisories

  • RHSA-2009:1432 Released 2009-09-09 · Red Hat rating Critical
    seamonkey security update
    • Red Hat Desktop version 3 seamonkey-1.0.9-0.45.el3, seamonkey-1.0.9-0.45.el3.i386, seamonkey-chat-1.0.9-0.45.el3 +17
    • Red Hat Enterprise Linux AS version 3 seamonkey-1.0.9-0.45.el3, seamonkey-1.0.9-0.45.el3.i386, seamonkey-1.0.9-0.45.el3.ia64 +37
    • Red Hat Enterprise Linux ES version 3 seamonkey-1.0.9-0.45.el3, seamonkey-1.0.9-0.45.el3.i386, seamonkey-1.0.9-0.45.el3.ia64 +27
    • Red Hat Enterprise Linux WS version 3 seamonkey-1.0.9-0.45.el3, seamonkey-1.0.9-0.45.el3.i386, seamonkey-1.0.9-0.45.el3.ia64 +27
  • RHSA-2009:1207 Released 2009-08-12 · Red Hat rating Critical
    nspr and nss security update
    • Red Hat Enterprise Linux EUS (v. 5.2 server) nspr-4.7.4-1.el5_2, nspr-4.7.4-1.el5_2.i386, nspr-4.7.4-1.el5_2.ia64 +21
  • RHSA-2009:1190 Released 2009-07-31 · Red Hat rating Critical
    nspr and nss security and bug fix update
    • Red Hat Enterprise Linux AS EUS (v. 4.7) nspr-4.7.4-1.el4_7.1, nspr-4.7.4-1.el4_7.1.i386, nspr-4.7.4-1.el4_7.1.ia64 +13
    • Red Hat Enterprise Linux ES EUS (v. 4.7) nspr-4.7.4-1.el4_7.1, nspr-4.7.4-1.el4_7.1.i386, nspr-4.7.4-1.el4_7.1.ia64 +9
Show 2 more Red Hat advisories
  • RHSA-2009:1186 Released 2009-07-30 · Red Hat rating Critical
    nspr and nss security, bug fix, and enhancement update
    • Red Hat Enterprise Linux (v. 5 server) nspr-4.7.4-1.el5_3.1, nspr-4.7.4-1.el5_3.1.i386, nspr-4.7.4-1.el5_3.1.ia64 +21
    • Red Hat Enterprise Linux Desktop (v. 5 client) nspr-4.7.4-1.el5_3.1, nspr-4.7.4-1.el5_3.1.i386, nss-3.12.3.99.3-1.el5_3.2 +3
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nspr-4.7.4-1.el5_3.1, nspr-devel-4.7.4-1.el5_3.1, nspr-devel-4.7.4-1.el5_3.1.i386 +5
  • RHSA-2009:1184 Released 2009-07-30 · Red Hat rating Critical
    nspr and nss security and bug fix update
    • Red Hat Enterprise Linux AS version 4 nspr-4.7.4-1.el4_8.1, nspr-4.7.4-1.el4_8.1.i386, nspr-4.7.4-1.el4_8.1.ia64 +17
    • Red Hat Enterprise Linux Desktop version 4 nspr-4.7.4-1.el4_8.1, nspr-4.7.4-1.el4_8.1.i386, nspr-devel-4.7.4-1.el4_8.1 +7
    • Red Hat Enterprise Linux ES version 4 nspr-4.7.4-1.el4_8.1, nspr-4.7.4-1.el4_8.1.i386, nspr-4.7.4-1.el4_8.1.ia64 +12
    • Red Hat Enterprise Linux WS version 4 nspr-4.7.4-1.el4_8.1, nspr-4.7.4-1.el4_8.1.i386, nspr-4.7.4-1.el4_8.1.ia64 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2009:1432
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1186
Red Hat Enterprise Linux AS EUS (v. 4.7)Fixed RHSA-2009:1190
Red Hat Enterprise Linux AS version 3Fixed RHSA-2009:1432
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:1184
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1186
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:1186
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:1184
Red Hat Enterprise Linux ES EUS (v. 4.7)Fixed RHSA-2009:1190
Red Hat Enterprise Linux ES version 3Fixed RHSA-2009:1432
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:1184
Red Hat Enterprise Linux EUS (v. 5.2 server)Fixed RHSA-2009:1207
Red Hat Enterprise Linux WS version 3Fixed RHSA-2009:1432
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:1184

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2408
  2. 2026-10-03 Alias added: GHSA-pm7c-vg9h-jxxc

References

Advisory 13

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences