CVE-2007-0009: Software Security Vulnerability Vulnerability

MODERATE
Advisory Identifier: GHSA-f72q-g9vm-gpmq
Share
CWE-119
Published
Advisory Summary

CVE-2007-0009 is a MODERATE security vulnerability vulnerability (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. this may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.. Remediation is available in the latest vendor maintenance releases.

CVE-2007-0009 at a Glance

CVE Identifier CVE-2007-0009
GHSA Identifier GHSA-f72q-g9vm-gpmq
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2007-0009

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2007-0009, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, where the product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. this may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid "Client Master Key" length values.

References

secunia.com/advisories/24522 WEB
http://secunia.com/advisories/24522
secunia.com/advisories/24562 WEB
http://secunia.com/advisories/24562
secunia.com/advisories/24650 WEB
http://secunia.com/advisories/24650
secunia.com/advisories/24703 WEB
http://secunia.com/advisories/24703
secunia.com/advisories/25588 WEB
http://secunia.com/advisories/25588
secunia.com/advisories/25597 WEB
http://secunia.com/advisories/25597
Software Security Information SECURITY
http://security.gentoo.org/glsa/glsa-200703-18.xml
Software Security Information SECURITY
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
Software Security Information SECURITY
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947
secunia.com/advisories/24456 WEB
http://secunia.com/advisories/24456
secunia.com/advisories/24457 WEB
http://secunia.com/advisories/24457
NVD — CVE-2007-0009 NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0009
bugzilla.mozilla.org/show_bug.cgi WEB
https://bugzilla.mozilla.org/show_bug.cgi?id=364323
exchange.xforce.ibmcloud.com/vulnerabilities/326... WEB
https://exchange.xforce.ibmcloud.com/vulnerabilities/32663
issues.rpath.com/browse/rpl-1081 WEB
https://issues.rpath.com/browse/RPL-1081
issues.rpath.com/browse/rpl-1103 WEB
https://issues.rpath.com/browse/RPL-1103
Software Security Information SECURITY
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10174
fedoranews.org/cms/node/2709 WEB
http://fedoranews.org/cms/node/2709
fedoranews.org/cms/node/2711 WEB
http://fedoranews.org/cms/node/2711
fedoranews.org/cms/node/2747 WEB
http://fedoranews.org/cms/node/2747
fedoranews.org/cms/node/2749 WEB
http://fedoranews.org/cms/node/2749
h20000.www2.hp.com/bizsupport/techsupp... WEB
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
labs.idefense.com/intelligence/vulner... WEB
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483
Software Security Information SECURITY
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
rhn.redhat.com/errata/rhsa-2007-00... WEB
http://rhn.redhat.com/errata/RHSA-2007-0077.html
secunia.com/advisories/24253 WEB
http://secunia.com/advisories/24253
secunia.com/advisories/24277 WEB
http://secunia.com/advisories/24277
secunia.com/advisories/24287 WEB
http://secunia.com/advisories/24287
secunia.com/advisories/24290 WEB
http://secunia.com/advisories/24290
secunia.com/advisories/24293 WEB
http://secunia.com/advisories/24293
secunia.com/advisories/24333 WEB
http://secunia.com/advisories/24333
secunia.com/advisories/24342 WEB
http://secunia.com/advisories/24342
secunia.com/advisories/24343 WEB
http://secunia.com/advisories/24343
secunia.com/advisories/24384 WEB
http://secunia.com/advisories/24384
secunia.com/advisories/24389 WEB
http://secunia.com/advisories/24389
secunia.com/advisories/24395 WEB
http://secunia.com/advisories/24395
secunia.com/advisories/24406 WEB
http://secunia.com/advisories/24406
secunia.com/advisories/24410 WEB
http://secunia.com/advisories/24410
secunia.com/advisories/24455 WEB
http://secunia.com/advisories/24455
Software Security Information SECURITY
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851
sunsolve.sun.com/search/document.do WEB
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1
sunsolve.sun.com/search/document.do WEB
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1
Software Security Information SECURITY
http://www.debian.org/security/2007/dsa-1336
Software Security Information SECURITY
http://www.gentoo.org/security/en/glsa/glsa-200703-22.xml
www.kb.cert.org/vuls/id/592796 WEB
http://www.kb.cert.org/vuls/id/592796
Software Security Information SECURITY
http://www.mandriva.com/security/advisories?name=MDKSA-2007:050
Software Security Information SECURITY
http://www.mandriva.com/security/advisories?name=MDKSA-2007:052
Software Security Information SECURITY
http://www.mozilla.org/security/announce/2007/mfsa2007-06.html
Software Security Information SECURITY
http://www.novell.com/linux/security/advisories/2007_22_mozilla.html
Software Security Information SECURITY
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
www.osvdb.org/32106 WEB
http://www.osvdb.org/32106
www.redhat.com/support/errata/rhsa... WEB
http://www.redhat.com/support/errata/RHSA-2007-0078.html
www.redhat.com/support/errata/rhsa... WEB
http://www.redhat.com/support/errata/RHSA-2007-0079.html
www.redhat.com/support/errata/rhsa... WEB
http://www.redhat.com/support/errata/RHSA-2007-0097.html
www.redhat.com/support/errata/rhsa... WEB
http://www.redhat.com/support/errata/RHSA-2007-0108.html
Software Security Information SECURITY
http://www.securityfocus.com/archive/1/461336/100/0/threaded
Software Security Information SECURITY
http://www.securityfocus.com/archive/1/461809/100/0/threaded
Software Security Information SECURITY
http://www.securityfocus.com/bid/64758
Software Security Information SECURITY
http://www.securitytracker.com/id?1017696
www.ubuntu.com/usn/usn-428-1 WEB
http://www.ubuntu.com/usn/usn-428-1
www.ubuntu.com/usn/usn-431-1 WEB
http://www.ubuntu.com/usn/usn-431-1
www.vupen.com/english/advisories/... WEB
http://www.vupen.com/english/advisories/2007/0718
www.vupen.com/english/advisories/... WEB
http://www.vupen.com/english/advisories/2007/0719
www.vupen.com/english/advisories/... WEB
http://www.vupen.com/english/advisories/2007/1165
www.vupen.com/english/advisories/... WEB
http://www.vupen.com/english/advisories/2007/2141

Frequently Asked Questions

What is CVE-2007-0009?
CVE-2007-0009 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2007-0009?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2007-0009?
CVE-2007-0009 is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer (The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.).
How can I check Maven dependencies for CVE-2007-0009?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f72q-g9vm-gpmq",
  "modified" : "2022-05-03T03:17:51Z",
  "published" : "2022-05-03T03:17:51Z",
  "aliases" : [ "CVE-2007-0009" ],
  "details" : "Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid \"Client Master Key\" length values.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2007-0009"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.mozilla.org/show_bug.cgi?id=364323"
  }, {
    "type" : "WEB",
    "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/32663"
  }, {
    "type" : "WEB",
    "url" : "https://issues.rpath.com/browse/RPL-1081"
  }, {
    "type" : "WEB",
    "url" : "https://issues.rpath.com/browse/RPL-1103"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10174"
  }, {
    "type" : "WEB",
    "url" : "http://fedoranews.org/cms/node/2709"
  }, {
    "type" : "WEB",
    "url" : "http://fedoranews.org/cms/node/2711"
  }, {
    "type" : "WEB",
    "url" : "http://fedoranews.org/cms/node/2747"
  }, {
    "type" : "WEB",
    "url" : "http://fedoranews.org/cms/node/2749"
  }, {
    "type" : "WEB",
    "url" : "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
  }, {
    "type" : "WEB",
    "url" : "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483"
  }, {
    "type" : "WEB",
    "url" : "http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2007-0077.html"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24253"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24277"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24287"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24290"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24293"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24333"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24342"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24343"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24384"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24389"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24395"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24406"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24410"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24455"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24456"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24457"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24522"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24562"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24650"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/24703"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/25588"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/25597"
  }, {
    "type" : "WEB",
    "url" : "http://security.gentoo.org/glsa/glsa-200703-18.xml"
  }, {
    "type" : "WEB",
    "url" : "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131"
  }, {
    "type" : "WEB",
    "url" : "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.363947"
  }, {
    "type" : "WEB",
    "url" : "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851"
  }, {
    "type" : "WEB",
    "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102856-1"
  }, {
    "type" : "WEB",
    "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-26-102945-1"
  }, {
    "type" : "WEB",
    "url" : "http://www.debian.org/security/2007/dsa-1336"
  }, {
    "type" : "WEB",
    "url" : "http://www.gentoo.org/security/en/glsa/glsa-200703-22.xml"
  }, {
    "type" : "WEB",
    "url" : "http://www.kb.cert.org/vuls/id/592796"
  }, {
    "type" : "WEB",
    "url" : "http://www.mandriva.com/security/advisories?name=MDKSA-2007:050"
  }, {
    "type" : "WEB",
    "url" : "http://www.mandriva.com/security/advisories?name=MDKSA-2007:052"
  }, {
    "type" : "WEB",
    "url" : "http://www.mozilla.org/security/announce/2007/mfsa2007-06.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.novell.com/linux/security/advisories/2007_22_mozilla.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.osvdb.org/32106"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2007-0078.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2007-0079.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2007-0097.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2007-0108.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/461336/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/461809/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/bid/64758"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1017696"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/usn-428-1"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/usn-431-1"
  }, {
    "type" : "WEB",
    "url" : "http://www.vupen.com/english/advisories/2007/0718"
  }, {
    "type" : "WEB",
    "url" : "http://www.vupen.com/english/advisories/2007/0719"
  }, {
    "type" : "WEB",
    "url" : "http://www.vupen.com/english/advisories/2007/1165"
  }, {
    "type" : "WEB",
    "url" : "http://www.vupen.com/english/advisories/2007/2141"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-119" ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2007-02-26T20:28:00Z"
  }
}