Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2009-2408

23
FAUCET Score

CVE-2009-2408 describes a critical vulnerability in Mozilla Network Security Services (NSS) and related products like Firefox, Thunderbird, and SeaMonkey. The flaw allows man-in-the-middle attackers to spoof SSL servers by exploiting improper handling of null characters in the Common Name field of X.509 certificates. This medium-severity vulnerability (CVSS 5.9) has a high impact on integrity, as it enables attackers to impersonate legitimate SSL servers, but requires high attack complexity. There is no evidence of active exploitation, public exploit code, or significant community discussion, suggesting a low current threat level.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.0.13CPE matchmatch criteria
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
< 3.12.3CPE matchmatch criteria
cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*
< 1.1.18CPE matchmatch criteria
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
< 2.0.0.23CPE matchmatch criteria
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
>= 10.3, <= 11.1CPE matchmatch criteria
cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.9MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
5.74%
Probability of exploitation in next 30 days
EPSS Percentile
92.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0574 is in the 91st percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (10)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5.2 Z StreamFixed in: nss-0:3.12.3.99.3-1.el5_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 3Fixed in: seamonkey-0:1.0.9-0.45.el3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: nspr-0:4.7.4-1.el4_8.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: nss-0:3.12.3.99.3-1.el4_8.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 4.7 Z StreamFixed in: nspr-0:4.7.4-1.el4_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 4.7 Z StreamFixed in: nss-0:3.12.3.99.3-1.el4_7.6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: nspr-0:4.7.4-1.el5_3.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: nss-0:3.12.3.99.3-1.el5_3.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5.2 Z StreamFixed in: nspr-0:4.7.4-1.el5_2
View patch
mozillavendor investigatingvia nvd_reference
View patch

Vendor Advisories (1)

redhatCVE-2009-2408Important

firefox/nss: doesn't handle NULL in Common Name properly

Jul 29, 2009

References

isc.sans.org / diary.html
Broken Link
lists.opensuse.org / opensuse-security-announce/2009-11/msg00004.html
Mailing List
marc.info
Mailing List
osvdb.org / 56723
Broken Link
bugzilla.redhat.com / show_bug.cgi
Issue Tracking
secunia.com / advisories/36088
Broken LinkVendor Advisory
secunia.com / advisories/36125
Broken LinkVendor Advisory
secunia.com / advisories/36139
Broken LinkVendor Advisory
secunia.com / advisories/36157
Broken LinkVendor Advisory
secunia.com / advisories/36434
Broken LinkVendor Advisory
secunia.com / advisories/36669
Broken Link
secunia.com / advisories/37098
Broken Link
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10751
Broken Link
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8458
Broken Link
sunsolve.sun.com / search/document.do
Broken Link
usn.ubuntu.com / 810-2
Broken Link
debian.org / security/2009/dsa-1874
Mailing List
mandriva.com / security/advisories
Broken Link
mandriva.com / security/advisories
Broken Link
mandriva.com / security/advisories
Broken Link
mozilla.org / security/announce/2009/mfsa2009-42.html
Vendor Advisory
novell.com / linux/security/advisories/2009_48_firefox.html
Broken Link
openldap.org / devel/cvsweb.cgi/libraries/libldap/tls_m.c.diff
Broken Link
redhat.com / support/errata/RHSA-2009-1207.html
Broken Link
redhat.com / support/errata/RHSA-2009-1432.html
Broken Link
securitytracker.com / id
Broken LinkThird Party AdvisoryVDB Entry
ubuntu.com / usn/usn-810-1
Third Party Advisory
vupen.com / english/advisories/2009/2085
Broken LinkVendor Advisory
vupen.com / english/advisories/2009/3184
Broken Link
wired.com / threatlevel/2009/07/kaminsky
Press/Media Coverage