Mozilla Products NSS Code Execution and Security Bypass Vulnerabilities

Two vulnerabilities have been identified in Mozilla Firefox, Thunderbird and Seamonkey, which could be exploited by remote attackers to bypass security restrictions or compromise a vulnerable system. These issues are caused by errors in NSS.

1. A heap overflow in a regular expression parser when checking if the hostname of a visited web site matches the Common Name (CN) field of the presented certificate, which could allow attackers to execute arbitrary code via a malicious certificate.

2. Anerror when handling NULL characters in a certificate, which could allow man-in-the-middle attacks.