high
7.5
CWE
NVD-CWE-Other 119
Advisory Published
Updated

CVE-2004-0826: Buffer Overflow

First published: Thu Sep 02 2004(Updated: )

Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Mozilla NSS ESR=3.2
Mozilla NSS ESR=3.2.1
Mozilla NSS ESR=3.3
Mozilla NSS ESR=3.3.1
Mozilla NSS ESR=3.3.2
Mozilla NSS ESR=3.4
Mozilla NSS ESR=3.4.1
Mozilla NSS ESR=3.4.2
Mozilla NSS ESR=3.5
Mozilla NSS ESR=3.6
Mozilla NSS ESR=3.6.1
Mozilla NSS ESR=3.7
Mozilla NSS ESR=3.7.1
Mozilla NSS ESR=3.7.2
Mozilla NSS ESR=3.7.3
Mozilla NSS ESR=3.7.5
Mozilla NSS ESR=3.7.7
Mozilla NSS ESR=3.8
Mozilla NSS ESR=3.9
Netscape Certificate Server=1.0-patch1
Netscape Certificate Server=4.2
Netscape Directory Server=1.3-patch5
Netscape Directory Server=3.1-patch1
Netscape Directory Server=3.12
Netscape Directory Server=4.1
Netscape Directory Server=4.11
Netscape Directory Server=4.13
Netscape Enterprise Server=2.0
Netscape Enterprise Server=2.0.1c
Netscape Enterprise Server=2.0a
Netscape Enterprise Server=3.0
Netscape Enterprise Server=3.0.1
Netscape Enterprise Server=3.0.1b
Netscape Enterprise Server=3.0.7a
Netscape Enterprise Server=3.0l
Netscape Enterprise Server=3.1
Netscape Enterprise Server=3.2
Netscape Enterprise Server=3.3
Netscape Enterprise Server=3.4
Netscape Enterprise Server=3.5
Netscape Enterprise Server=3.5
Netscape Enterprise Server=3.5.1
Netscape Enterprise Server=3.6
Netscape Enterprise Server=3.6
Netscape Enterprise Server=3.6-sp1
Netscape Enterprise Server=3.6-sp2
Netscape Enterprise Server=3.6-sp3
Netscape Enterprise Server=4.0
Netscape Enterprise Server=4.1-sp3
Netscape Enterprise Server=4.1-sp4
Netscape Enterprise Server=4.1-sp5
Netscape Enterprise Server=4.1-sp6
Netscape Enterprise Server=4.1-sp7
Netscape Enterprise Server=4.1-sp8
Netscape Enterprise Server=4.1.1
Netscape Enterprise Server=5.0
Netscape Personalization Engine
Sun Java Enterprise System=2003q4
Sun Java Enterprise System=2004q2
Sun ONE Application Server=7.0
Sun ONE Application Server=7.0
Sun ONE Application Server=7.0
Sun ONE Application Server=7.0-ur4
Sun ONE Application Server=7.1
Sun ONE Application Server=6.0
Sun ONE Application Server=6.0-sp1
Sun ONE Application Server=6.0-sp2
iPlanet Web Server=4.1
iPlanet Web Server=4.1-sp1
iPlanet Web Server=4.1-sp10
iPlanet Web Server=4.1-sp11
iPlanet Web Server=4.1-sp12
iPlanet Web Server=4.1-sp13
iPlanet Web Server=4.1-sp14
iPlanet Web Server=4.1-sp2
iPlanet Web Server=4.1-sp3
iPlanet Web Server=4.1-sp4
iPlanet Web Server=4.1-sp5
iPlanet Web Server=4.1-sp6
iPlanet Web Server=4.1-sp7
iPlanet Web Server=4.1-sp8
iPlanet Web Server=4.1-sp9
iPlanet Web Server=6.0-sp3
iPlanet Web Server=6.0-sp4
iPlanet Web Server=6.0-sp5
iPlanet Web Server=6.0-sp7
iPlanet Web Server=6.0-sp8
iPlanet Web Server=6.1
iPlanet Web Server=6.1-sp1
iPlanet Web Server=6.1-sp2
HPE HP-UX=11.00
HPE HP-UX=11.11
HPE HP-UX=11.23

Remedy

http://www.securityfocus.com/bid/11015

Remedy

http://xforce.iss.net/xforce/alerts/id/180

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2004-0826?

    CVE-2004-0826 has a high severity rating due to its potential for remote code execution.

  • How do I fix CVE-2004-0826?

    To fix CVE-2004-0826, update the Netscape Network Security Services library to a patched version.

  • What systems are affected by CVE-2004-0826?

    CVE-2004-0826 affects multiple versions of the Netscape Network Security Services library, including versions 3.2 through 3.9.

  • What kind of attack does CVE-2004-0826 allow?

    CVE-2004-0826 allows remote attackers to execute arbitrary code on affected systems.

  • When was CVE-2004-0826 disclosed?

    CVE-2004-0826 was disclosed in 2004, revealing significant vulnerabilities in SSLv2.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203