Total vulnerabilities in the database
Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.
| Software | From | Fixed in |
|---|---|---|
| mozilla / network_security_services | - | 3.12.3 |
| mozilla / firefox | - | 3.0.13 |
| mozilla / seamonkey | - | 1.1.18 |
| mozilla / thunderbird | - | 2.0.0.23 |
| suse / linux_enterprise_server | 9 | 9.x |
| suse / linux_enterprise | 11.0 | 11.0.x |
| suse / linux_enterprise | 10.0 | 10.0.x |
| opensuse / opensuse | 10.3 | 11.1.x |
| debian / debian_linux | 5.0 | 5.0.x |
| canonical / ubuntu_linux | 9.04 | 9.04.x |
| canonical / ubuntu_linux | 8.10 | 8.10.x |
| canonical / ubuntu_linux | 8.04 | 8.04.x |