Unrated severityNVD Advisory· Published Feb 26, 2007· Updated Jun 16, 2026
CVE-2007-0008
CVE-2007-0008
Description
Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
91cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 43 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <=1.5.0.9
- cpe:2.3:a:mozilla:firefox:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
- (no CPE)range: <1.5.0.10, 2.x < 2.0.0.2
cpe:2.3:a:mozilla:network_security_services:3.11.2:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:mozilla:network_security_services:3.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.11.4:*:*:*:*:*:*:*
- (no CPE)range: <3.11.5
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*range: <=1.0.7
- cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*
- (no CPE)range: <1.0.8
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 31 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <=1.5.0.9
- cpe:2.3:a:mozilla:thunderbird:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*
- osv-coords2 versionspkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed
< 128.5.1-1.1+ 1 more
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 92.0-1.2
Patches
Vulnerability mechanics
References
74- www.mozilla.org/security/announce/2007/mfsa2007-06.htmlnvdPatchVendor Advisory
- labs.idefense.com/intelligence/vulnerabilities/display.phpnvdVendor Advisory
- secunia.com/advisories/24205nvdVendor Advisory
- secunia.com/advisories/24238nvdVendor Advisory
- secunia.com/advisories/24252nvdVendor Advisory
- secunia.com/advisories/24253nvdVendor Advisory
- secunia.com/advisories/24277nvdVendor Advisory
- secunia.com/advisories/24287nvdVendor Advisory
- secunia.com/advisories/24290nvdVendor Advisory
- secunia.com/advisories/24293nvdVendor Advisory
- secunia.com/advisories/24320nvdVendor Advisory
- secunia.com/advisories/24328nvdVendor Advisory
- secunia.com/advisories/24333nvdVendor Advisory
- secunia.com/advisories/24343nvdVendor Advisory
- secunia.com/advisories/24384nvdVendor Advisory
- secunia.com/advisories/24389nvdVendor Advisory
- secunia.com/advisories/24395nvdVendor Advisory
- secunia.com/advisories/24410nvdVendor Advisory
- secunia.com/advisories/24522nvdVendor Advisory
- secunia.com/advisories/24562nvdVendor Advisory
- secunia.com/advisories/24650nvdVendor Advisory
- secunia.com/advisories/24703nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdVendor Advisory
- www.kb.cert.org/vuls/id/377812nvdUS Government Resource
- patches.sgi.com/support/free/security/advisories/20070202-01-P.ascnvd
- patches.sgi.com/support/free/security/advisories/20070301-01-P.ascnvd
- fedoranews.org/cms/node/2709nvd
- fedoranews.org/cms/node/2711nvd
- fedoranews.org/cms/node/2713nvd
- fedoranews.org/cms/node/2728nvd
- fedoranews.org/cms/node/2747nvd
- fedoranews.org/cms/node/2749nvd
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jspnvd
- lists.suse.com/archive/suse-security-announce/2007-Mar/0001.htmlnvd
- rhn.redhat.com/errata/RHSA-2007-0077.htmlnvd
- secunia.com/advisories/24342nvd
- secunia.com/advisories/24406nvd
- secunia.com/advisories/24455nvd
- secunia.com/advisories/24456nvd
- secunia.com/advisories/24457nvd
- secunia.com/advisories/25588nvd
- secunia.com/advisories/25597nvd
- security.gentoo.org/glsa/glsa-200703-18.xmlnvd
- slackware.com/security/viewer.phpnvd
- slackware.com/security/viewer.phpnvd
- slackware.com/security/viewer.phpnvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- www.debian.org/security/2007/dsa-1336nvd
- www.gentoo.org/security/en/glsa/glsa-200703-22.xmlnvd
- www.mandriva.com/security/advisoriesnvd
- www.mandriva.com/security/advisoriesnvd
- www.novell.com/linux/security/advisories/2007_22_mozilla.htmlnvd
- www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlnvd
- www.osvdb.org/32105nvd
- www.redhat.com/support/errata/RHSA-2007-0078.htmlnvd
- www.redhat.com/support/errata/RHSA-2007-0079.htmlnvd
- www.redhat.com/support/errata/RHSA-2007-0097.htmlnvd
- www.redhat.com/support/errata/RHSA-2007-0108.htmlnvd
- www.securityfocus.com/archive/1/461336/100/0/threadednvd
- www.securityfocus.com/archive/1/461809/100/0/threadednvd
- www.securityfocus.com/bid/22694nvd
- www.securityfocus.com/bid/64758nvd
- www.securitytracker.com/idnvd
- www.ubuntu.com/usn/usn-428-1nvd
- www.ubuntu.com/usn/usn-431-1nvd
- www.vupen.com/english/advisories/2007/0718nvd
- www.vupen.com/english/advisories/2007/0719nvd
- www.vupen.com/english/advisories/2007/1165nvd
- www.vupen.com/english/advisories/2007/2141nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/32666nvd
- issues.rpath.com/browse/RPL-1081nvd
- issues.rpath.com/browse/RPL-1103nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10502nvd
News mentions
0No linked articles in our index yet.