Lucene search

[email protected]NVD:CVE-2007-0008

HistoryFeb 26, 2007 - 8:28 p.m.

CVE-2007-0008

2007-02-2620:28:00

CWE-189

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

Low

EPSS

0.969

Percentile

99.7%

JSON

Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the “Master Secret”, which results in a heap-based overflow.

Affected configurations

Nvd

Node

mozillafirefoxRange≤1.5.0.9

mozillafirefoxMatch0.1

mozillafirefoxMatch0.2

mozillafirefoxMatch0.3

mozillafirefoxMatch0.4

mozillafirefoxMatch0.5

mozillafirefoxMatch0.6

mozillafirefoxMatch0.6.1

mozillafirefoxMatch0.7

mozillafirefoxMatch0.7.1

mozillafirefoxMatch0.8

mozillafirefoxMatch0.9

mozillafirefoxMatch0.9rc

mozillafirefoxMatch0.9.1

mozillafirefoxMatch0.9.2

mozillafirefoxMatch0.9.3

mozillafirefoxMatch0.10

mozillafirefoxMatch0.10.1

mozillafirefoxMatch1.0

mozillafirefoxMatch1.0preview_release

mozillafirefoxMatch1.0.1

mozillafirefoxMatch1.0.2

mozillafirefoxMatch1.0.3

mozillafirefoxMatch1.0.4

mozillafirefoxMatch1.0.5

mozillafirefoxMatch1.0.6

mozillafirefoxMatch1.0.7

mozillafirefoxMatch1.0.8

mozillafirefoxMatch1.4.1

mozillafirefoxMatch1.5

mozillafirefoxMatch1.5.0.1

mozillafirefoxMatch1.5.0.2

mozillafirefoxMatch1.5.0.3

mozillafirefoxMatch1.5.0.4

mozillafirefoxMatch1.5.0.5

mozillafirefoxMatch1.5.0.6

mozillafirefoxMatch1.5.0.7

mozillafirefoxMatch1.5.0.8

mozillafirefoxMatch1.5.0.10

mozillafirefoxMatch1.5.0.11

mozillafirefoxMatch1.5.0.12

mozillafirefoxMatch2.0

mozillafirefoxMatch2.0.0.1

mozillanetwork_security_servicesMatch3.11.2

mozillanetwork_security_servicesMatch3.11.3

mozillanetwork_security_servicesMatch3.11.4

mozillaseamonkeyRange≤1.0.7

mozillaseamonkeyMatch1.0

mozillaseamonkeyMatch1.0.1

mozillaseamonkeyMatch1.0.2

mozillaseamonkeyMatch1.0.3

mozillaseamonkeyMatch1.0.4

mozillaseamonkeyMatch1.0.5

mozillaseamonkeyMatch1.0.6

mozillathunderbirdRange≤1.5.0.9

mozillathunderbirdMatch0.1

mozillathunderbirdMatch0.2

mozillathunderbirdMatch0.3

mozillathunderbirdMatch0.4

mozillathunderbirdMatch0.5

mozillathunderbirdMatch0.6

mozillathunderbirdMatch0.7

mozillathunderbirdMatch0.7.1

mozillathunderbirdMatch0.7.2

mozillathunderbirdMatch0.7.3

mozillathunderbirdMatch0.8

mozillathunderbirdMatch0.9

mozillathunderbirdMatch1.0

mozillathunderbirdMatch1.0.1

mozillathunderbirdMatch1.0.2

mozillathunderbirdMatch1.0.3

mozillathunderbirdMatch1.0.4

mozillathunderbirdMatch1.0.5

mozillathunderbirdMatch1.0.6

mozillathunderbirdMatch1.0.7

mozillathunderbirdMatch1.0.8

mozillathunderbirdMatch1.5

mozillathunderbirdMatch1.5beta2

mozillathunderbirdMatch1.5.0.1

mozillathunderbirdMatch1.5.0.2

mozillathunderbirdMatch1.5.0.3

mozillathunderbirdMatch1.5.0.4

mozillathunderbirdMatch1.5.0.5

mozillathunderbirdMatch1.5.0.6

mozillathunderbirdMatch1.5.0.7

mozillathunderbirdMatch1.5.0.8

References

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc

ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc

fedoranews.org/cms/node/2709

fedoranews.org/cms/node/2711

fedoranews.org/cms/node/2713

fedoranews.org/cms/node/2728

fedoranews.org/cms/node/2747

fedoranews.org/cms/node/2749

h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

labs.idefense.com/intelligence/vulnerabilities/display.php?id=482

lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html

rhn.redhat.com/errata/RHSA-2007-0077.html

secunia.com/advisories/24205

secunia.com/advisories/24238

secunia.com/advisories/24252

secunia.com/advisories/24253

secunia.com/advisories/24277

secunia.com/advisories/24287

secunia.com/advisories/24290

secunia.com/advisories/24293

secunia.com/advisories/24320

secunia.com/advisories/24328

secunia.com/advisories/24333

secunia.com/advisories/24342

secunia.com/advisories/24343

secunia.com/advisories/24384

secunia.com/advisories/24389

secunia.com/advisories/24395

secunia.com/advisories/24406

secunia.com/advisories/24410

secunia.com/advisories/24455

secunia.com/advisories/24456

secunia.com/advisories/24457

secunia.com/advisories/24522

secunia.com/advisories/24562

secunia.com/advisories/24650

secunia.com/advisories/24703

secunia.com/advisories/25588

secunia.com/advisories/25597

security.gentoo.org/glsa/glsa-200703-18.xml

slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947

slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851

sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1

sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1

www.debian.org/security/2007/dsa-1336

www.gentoo.org/security/en/glsa/glsa-200703-22.xml

www.kb.cert.org/vuls/id/377812

www.mandriva.com/security/advisories?name=MDKSA-2007:050

www.mandriva.com/security/advisories?name=MDKSA-2007:052

www.mozilla.org/security/announce/2007/mfsa2007-06.html

www.novell.com/linux/security/advisories/2007_22_mozilla.html

www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

www.osvdb.org/32105

www.redhat.com/support/errata/RHSA-2007-0078.html

www.redhat.com/support/errata/RHSA-2007-0079.html

www.redhat.com/support/errata/RHSA-2007-0097.html

www.redhat.com/support/errata/RHSA-2007-0108.html

www.securityfocus.com/archive/1/461336/100/0/threaded

www.securityfocus.com/archive/1/461809/100/0/threaded

www.securityfocus.com/bid/22694

www.securityfocus.com/bid/64758

www.securitytracker.com/id?1017696

www.ubuntu.com/usn/usn-428-1

www.ubuntu.com/usn/usn-431-1

www.vupen.com/english/advisories/2007/0718

www.vupen.com/english/advisories/2007/0719

www.vupen.com/english/advisories/2007/1165

www.vupen.com/english/advisories/2007/2141

bugzilla.mozilla.org/show_bug.cgi?id=364319

exchange.xforce.ibmcloud.com/vulnerabilities/32666

issues.rpath.com/browse/RPL-1081

issues.rpath.com/browse/RPL-1103

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10502

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

Low

EPSS

0.969

Percentile

99.7%

JSON

Related for NVD:CVE-2007-0008

cvelist1 checkpoint_advisories1 veracode1 cert1 securityvulns4 ubuntucve1 prion1 cve1 openvas34 nessus39 fedora4 gentoo2 mozilla1 ubuntu3 osv1 debian1 redhat5 freebsd1 oraclelinux3 centos5 suse2 oracle1