A heap overflow vulnerability in Network Security Services (NSS) may allow a remote SSL server to cause a Denial of Service (DoS) to SSL client applications or to possibly execute arbitrary code with the privileges of the SSL client application, via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the "cert_TestHostName" function.

Firefox, Thunderbird, Pidgin and Evolution are examples of vulnerable SSL client applications.

This issue is also described in the following document:

    CVE-2009-2404 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2404

Permalink |