firefox: heap overflow in certificate regexp parsing
| Package(s): | firefox |
CVE #(s): | CVE-2009-2404
|
| Created: | August 4, 2009 |
Updated: | March 31, 2010 |
| Description: |
From the Mozilla
advisory: Moxie Marlinspike reported a heap overflow vulnerability in
the code that handles regular expressions in certificate names. This
vulnerability could be used to compromise the browser and run arbitrary
code by presenting a specially crafted certificate to the client. This code
provided compatibility with the non-standard regular expression syntax
historically supported by Netscape clients and servers. With version 3.5
Firefox switched to the more limited industry-standard wildcard syntax
instead and is not vulnerable to this flaw. |
| Alerts: |
|
