CVEvulnerability
CVE-2004-0826
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2004-12-31
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.
Affected configurations
• mozilla network security services 3.2
• mozilla network security services 3.2.1
• mozilla network security services 3.3
• mozilla network security services 3.3.1
• mozilla network security services 3.3.2
• mozilla network security services 3.4
• mozilla network security services 3.4.1
• mozilla network security services 3.4.2
• mozilla network security services 3.5
• mozilla network security services 3.6
• mozilla network security services 3.6.1
• mozilla network security services 3.7
• mozilla network security services 3.7.1
• mozilla network security services 3.7.2
• mozilla network security services 3.7.3
• mozilla network security services 3.7.5
• mozilla network security services 3.7.7
• mozilla network security services 3.8
• mozilla network security services 3.9
• netscape certificate server 1.0
• netscape certificate server 4.2
• netscape directory server 1.3
• netscape directory server 3.1
• netscape directory server 3.12
• netscape directory server 4.1
• netscape directory server 4.11
• netscape directory server 4.13
• netscape enterprise server 2.0
• netscape enterprise server 2.0.1c
• netscape enterprise server 2.0a
• netscape enterprise server 3.0
• netscape enterprise server 3.0.1
• netscape enterprise server 3.0.1b
• netscape enterprise server 3.0.7a
• netscape enterprise server 3.0l
• netscape enterprise server 3.1
• netscape enterprise server 3.2
• netscape enterprise server 3.3
• netscape enterprise server 3.4
• netscape enterprise server 3.5
• netscape enterprise server 3.5.1
• netscape enterprise server 3.6
• netscape enterprise server 4.0
• netscape enterprise server 4.1
• netscape enterprise server 4.1.1
• netscape enterprise server 5.0
• netscape personalization engine
• sun java enterprise system 2003q4
• sun java enterprise system 2004q2
• sun java system application server 7.0
• sun java system application server 7.1
• sun one application server 6.0
• sun one web server 4.1
• sun one web server 6.0
• sun one web server 6.1
• hp hp-ux 11.00
• hp hp-ux 11.11
• hp hp-ux 11.23
Related
Referenced by CWE · observed example (1)
- CWE-130 Improper Handling of Length Parameter Inconsistency weakness
References
- http://marc.info/?l=bugtraq&m=109351293827731&w=2 marc.info
- http://www.securityfocus.com/bid/11015 Patch
- http://xforce.iss.net/xforce/alerts/id/180 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16314 exchange.xforce.ibmcloud.com
- http://marc.info/?l=bugtraq&m=109351293827731&w=2 marc.info
- http://www.securityfocus.com/bid/11015 Patch
- http://xforce.iss.net/xforce/alerts/id/180 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16314 exchange.xforce.ibmcloud.com