Every CVE Search/ Get API key

CVE-2009-2408

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before...

5.9 MediumFix available

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

5.74%Up 3.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.9

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Record
CVE-2009-2408
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-295
Updated
2026-11-02
CVE List No score

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Record
CVE-2009-2408
Updated
2026-11-02
EUVDEUVD-2009-2404 No score

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Record
EUVD-2009-2404
Updated
2026-11-03
GitHub AdvisoriesGHSA-pm7c-vg9h-jxxc 5.9

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before...

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Record
GHSA-pm7c-vg9h-jxxc
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20, CWE-295
Updated
2026-11-02
OSV 5.9

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Record
CVE-2009-2408
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2009-2408 5.9

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Record
DEBIAN-CVE-2009-2408
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nss
Debian:12
 before 3.12.3-1
3.12.3-1
nss
Debian:13
 before 3.12.3-1
3.12.3-1
nss
Debian:14
 before 3.12.3-1
3.12.3-1
nss
Debian:5.0
 before 3.12.3.1-0lenny1, plus listed versions
3.12.0-53.12.0-63.12.1-13.12.2.with.ckbi.1.73-13.12.2.with.ckbi.1.73-23.12.3-1
3.12.3.1-0lenny1
icedove
Debian:5.0
 before 2.0.0.24-0lenny1, plus listed versions
2.0.0.19-12.0.0.19-1+kbsd2.0.0.22-0lenny12.0.0.22-12.0.0.22-1.1
2.0.0.24-0lenny1
nspr
Red Hat:enterprise_linux:4::as
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nspr-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nspr-devel
Red Hat:enterprise_linux:4::as
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nss
Red Hat:enterprise_linux:4::as
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
Show 107 moreShow less
Affected packages
PackageAffectedFixed
nss-devel
Red Hat:enterprise_linux:4::as
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-tools
Red Hat:enterprise_linux:4::as
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nspr
Red Hat:enterprise_linux:4::desktop
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nspr-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nspr-devel
Red Hat:enterprise_linux:4::desktop
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nss
Red Hat:enterprise_linux:4::desktop
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-devel
Red Hat:enterprise_linux:4::desktop
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-tools
Red Hat:enterprise_linux:4::desktop
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nspr
Red Hat:enterprise_linux:4::es
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nspr-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nspr-devel
Red Hat:enterprise_linux:4::es
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nss
Red Hat:enterprise_linux:4::es
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-devel
Red Hat:enterprise_linux:4::es
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-tools
Red Hat:enterprise_linux:4::es
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nspr
Red Hat:enterprise_linux:4::ws
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nspr-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nspr-devel
Red Hat:enterprise_linux:4::ws
 before 0:4.7.4-1.el4_8.1
0:4.7.4-1.el4_8.1
nss
Red Hat:enterprise_linux:4::ws
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-devel
Red Hat:enterprise_linux:4::ws
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nss-tools
Red Hat:enterprise_linux:4::ws
 before 0:3.12.3.99.3-1.el4_8.2
0:3.12.3.99.3-1.el4_8.2
nspr
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.7.4-1.el5_3.1
0:4.7.4-1.el5_3.1
nspr-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.7.4-1.el5_3.1
0:4.7.4-1.el5_3.1
nspr-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.7.4-1.el5_3.1
0:4.7.4-1.el5_3.1
nss
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-pkcs11-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nspr
Red Hat:enterprise_linux:5::client
 before 0:4.7.4-1.el5_3.1
0:4.7.4-1.el5_3.1
nspr-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:4.7.4-1.el5_3.1
0:4.7.4-1.el5_3.1
nss
Red Hat:enterprise_linux:5::client
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-tools
Red Hat:enterprise_linux:5::client
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nspr
Red Hat:enterprise_linux:5::server
 before 0:4.7.4-1.el5_3.1
0:4.7.4-1.el5_3.1
nspr-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:4.7.4-1.el5_3.1
0:4.7.4-1.el5_3.1
nspr-devel
Red Hat:enterprise_linux:5::server
 before 0:4.7.4-1.el5_3.1
0:4.7.4-1.el5_3.1
nss
Red Hat:enterprise_linux:5::server
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-devel
Red Hat:enterprise_linux:5::server
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-pkcs11-devel
Red Hat:enterprise_linux:5::server
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nss-tools
Red Hat:enterprise_linux:5::server
 before 0:3.12.3.99.3-1.el5_3.2
0:3.12.3.99.3-1.el5_3.2
nspr
Red Hat:rhel_eus:4.7::as
 before 0:4.7.4-1.el4_7.1
0:4.7.4-1.el4_7.1
nspr-debuginfo
Red Hat:rhel_eus:4.7::as
 before 0:4.7.4-1.el4_7.1
0:4.7.4-1.el4_7.1
nspr-devel
Red Hat:rhel_eus:4.7::as
 before 0:4.7.4-1.el4_7.1
0:4.7.4-1.el4_7.1
nss
Red Hat:rhel_eus:4.7::as
 before 0:3.12.3.99.3-1.el4_7.6
0:3.12.3.99.3-1.el4_7.6
nss-debuginfo
Red Hat:rhel_eus:4.7::as
 before 0:3.12.3.99.3-1.el4_7.6
0:3.12.3.99.3-1.el4_7.6
nss-devel
Red Hat:rhel_eus:4.7::as
 before 0:3.12.3.99.3-1.el4_7.6
0:3.12.3.99.3-1.el4_7.6
nspr
Red Hat:rhel_eus:4.7::es
 before 0:4.7.4-1.el4_7.1
0:4.7.4-1.el4_7.1
nspr-debuginfo
Red Hat:rhel_eus:4.7::es
 before 0:4.7.4-1.el4_7.1
0:4.7.4-1.el4_7.1
nspr-devel
Red Hat:rhel_eus:4.7::es
 before 0:4.7.4-1.el4_7.1
0:4.7.4-1.el4_7.1
nss
Red Hat:rhel_eus:4.7::es
 before 0:3.12.3.99.3-1.el4_7.6
0:3.12.3.99.3-1.el4_7.6
nss-debuginfo
Red Hat:rhel_eus:4.7::es
 before 0:3.12.3.99.3-1.el4_7.6
0:3.12.3.99.3-1.el4_7.6
nss-devel
Red Hat:rhel_eus:4.7::es
 before 0:3.12.3.99.3-1.el4_7.6
0:3.12.3.99.3-1.el4_7.6
nspr
Red Hat:rhel_eus:5.2
 before 0:4.7.4-1.el5_2
0:4.7.4-1.el5_2
nspr-debuginfo
Red Hat:rhel_eus:5.2
 before 0:4.7.4-1.el5_2
0:4.7.4-1.el5_2
nspr-devel
Red Hat:rhel_eus:5.2
 before 0:4.7.4-1.el5_2
0:4.7.4-1.el5_2
nss
Red Hat:rhel_eus:5.2
 before 0:3.12.3.99.3-1.el5_2
0:3.12.3.99.3-1.el5_2
nss-debuginfo
Red Hat:rhel_eus:5.2
 before 0:3.12.3.99.3-1.el5_2
0:3.12.3.99.3-1.el5_2
nss-devel
Red Hat:rhel_eus:5.2
 before 0:3.12.3.99.3-1.el5_2
0:3.12.3.99.3-1.el5_2
nss-pkcs11-devel
Red Hat:rhel_eus:5.2
 before 0:3.12.3.99.3-1.el5_2
0:3.12.3.99.3-1.el5_2
nss-tools
Red Hat:rhel_eus:5.2
 before 0:3.12.3.99.3-1.el5_2
0:3.12.3.99.3-1.el5_2
seamonkey
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-chat
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-devel
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-dom-inspector
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-js-debugger
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-mail
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nspr
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nspr-devel
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nss
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nss-devel
Red Hat:enterprise_linux:3::as
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-chat
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-devel
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-dom-inspector
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-js-debugger
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-mail
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nspr
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nspr-devel
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nss
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nss-devel
Red Hat:enterprise_linux:3::desktop
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-chat
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-devel
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-dom-inspector
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-js-debugger
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-mail
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nspr
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nspr-devel
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nss
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nss-devel
Red Hat:enterprise_linux:3::es
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-chat
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-devel
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-dom-inspector
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-js-debugger
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-mail
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nspr
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nspr-devel
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nss
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3
seamonkey-nss-devel
Red Hat:enterprise_linux:3::ws
 before 0:1.0.9-0.45.el3
0:1.0.9-0.45.el3

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-2408 is a medium vulnerability (CVSS 5.9) in Mozilla Firefox, published July 30, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.74%, the 93rd percentile. Fixed in nss 3.12.3-1.

References

Show 73 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open