CVE-2008-2809: mozilla firefox Improper Input Validation

Vulnerability summary

CVE-2008-2809 is a medium (CVSS 4.0) Improper Input Validation vulnerability in mozilla firefox. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 68.6% of scored vulnerabilities.

Timeline

1. 08-07-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.