CVE:CVE-2007-0008
CNNVD:CNNVD-200702-518
Mozilla Firefox/SeaMonkey/Thunderbird都是Mozilla发布的WEB浏览器和邮件新闻组客户端产品。
网络安全服务(NSS)代码在处理SSLv2服务器消息时存在整数下溢错误。如果证书的公钥过小无法加密Master Secret的话，则用户使用了该证书就会触发堆溢出，导致执行任意代码。
solution:Upgrade mozilla firefox to a higher version than 1.5.0.9,0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.7,0.7.1,0.8,0.9,0.9:rc,0.9.1,0.9.2,0.9.3,0.10,0.10.1,1.0,1.0:preview_release,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.4.1,1.5,1.5.0.1,1.5.0.2,1.5.0.3,1.5.0.4,1.5.0.5,1.5.0.6,1.5.0.7,1.5.0.8,1.5.0.10,1.5.0.11,1.5.0.12,2.0,2.0.0.1,and avoid the version (,1.5.0.9],0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.7,0.7.1,0.8,0.9,0.9:rc,0.9.1,0.9.2,0.9.3,0.10,0.10.1,1.0,1.0:preview_release,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.4.1,1.5,1.5.0.1,1.5.0.2,1.5.0.3,1.5.0.4,1.5.0.5,1.5.0.6,1.5.0.7,1.5.0.8,1.5.0.10,1.5.0.11,1.5.0.12,2.0,2.0.0.1; Upgrade mozilla network_security_services to a higher version than 3.11.2,3.11.3,3.11.4,and avoid the version 3.11.2,3.11.3,3.11.4; Upgrade mozilla seamonkey to a higher version than 1.0.7,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,and avoid the version (,1.0.7],1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6; Upgrade mozilla thunderbird to a higher version than 1.5.0.9,0.1,0.2,0.3,0.4,0.5,0.6,0.7,0.7.1,0.7.2,0.7.3,0.8,0.9,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.5,1.5:beta2,1.5.0.1,1.5.0.2,1.5.0.3,1.5.0.4,1.5.0.5,1.5.0.6,1.5.0.7,1.5.0.8,and avoid the version (,1.5.0.9],0.1,0.2,0.3,0.4,0.5,0.6,0.7,0.7.1,0.7.2,0.7.3,0.8,0.9,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.5,1.5:beta2,1.5.0.1,1.5.0.2,1.5.0.3,1.5.0.4,1.5.0.5,1.5.0.6,1.5.0.7,1.5.0.8