The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade ja-linux-mozillafirebird-gtk1Upgrade el-linux-mozillafirebirdUpgrade mozillaUpgrade phoenixUpgrade ja-netscape7Upgrade fr-netscape7Upgrade mozilla+ipv6Upgrade linux-netscapeUpgrade fr-linux-netscapeUpgrade ja-linux-netscapeUpgrade linux-mozilla-develUpgrade linux-mozillafirebirdUpgrade ru-linux-mozillafirebirdUpgrade thunderbirdUpgrade firefoxUpgrade linux-phoenixUpgrade linux-mozillaUpgrade mozilla-firebirdUpgrade mozilla-embeddedUpgrade zhTW-linux-mozillafirebirdUpgrade de-linux-mozillafirebirdUpgrade netscape7Upgrade de-netscape7Upgrade mozilla-gtkUpgrade ja-mozillafirebird-gtk2Upgrade de-linux-netscapeUpgrade zhCN-linux-mozillafirebirdUpgrade mozilla-thunderbirdUpgrade mozilla-gtk2Upgrade pt_BR-netscape7Upgrade mozilla-gtk1 | Dec 10, 2025 | Sep 30, 2004 |
| Suse | — | Upgrade mozilla-ircUpgrade mozilla-dom-inspectorUpgrade mozilla-calendarUpgrade mozilla-mailUpgrade mozilla-venkmanUpgrade mozilla | Feb 17, 2015 | Aug 18, 2004 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub