CVE-2004-0826
CVE-2004-0826 is a high-severity vulnerability in Mozilla Network Security Services with a CVSS 2.0 base score of 7.5. Its EPSS exploit-prediction score of 23% places it in the 97th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: High (CVSS 2.0 base score 7.5)
- EPSS exploit prediction: 23% (97th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Mozilla Network Security Services
- Published:
- Last modified:
Description
Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.
Frequently asked questions
- What is CVE-2004-0826?
- Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.
- How severe is CVE-2004-0826?
- CVE-2004-0826 has a CVSS 2.0 base score of 7.5, rated high severity.
- Is CVE-2004-0826 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 23% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2004-0826?
- CVE-2004-0826 primarily affects Mozilla Network Security Services. In total, 93 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2004-0826?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2004-0826 published?
- CVE-2004-0826 was published on 2004-12-31 and last updated on 2026-06-16.
References
- http://marc.info/?l=bugtraq&m=109351293827731&w=2
- http://www.securityfocus.com/bid/11015
- http://xforce.iss.net/xforce/alerts/id/180
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16314
Affected products (93)
- cpe:2.3:a:mozilla:network_security_services:3.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:3.9:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:certificate_server:1.0:patch1:*:*:*:*:*:*
- cpe:2.3:a:netscape:certificate_server:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:directory_server:1.3:patch5:*:*:*:*:*:*
- cpe:2.3:a:netscape:directory_server:3.1:patch1:*:*:*:*:*:*
- cpe:2.3:a:netscape:directory_server:3.12:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:directory_server:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:directory_server:4.11:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:directory_server:4.13:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:2.0.1c:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:2.0a:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.0.1b:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.0.7a:*:netware:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.0l:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.2:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.3:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.4:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:enterprise_server:3.5:*:*:*:*:*:*:*
More vulnerabilities in Mozilla Network Security Services
- CVE-2014-1544 — Critical (CVSS 10.0): Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services…
- CVE-2019-17006 — Critical (CVSS 9.8): In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases…
- CVE-2017-5461 — Critical (CVSS 9.8): Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and…
- CVE-2015-7182 — Critical (CVSS 9.8): Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x…
- CVE-2014-1490 — Critical (CVSS 9.3): Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before…
- CVE-2009-2404 — Critical (CVSS 9.3): Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as…