Non notée
CVE-2021-43527 NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling…
Description
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
Produits et versions touchés
Références
- www.mozilla.org www.mozilla.org
- bugzilla.mozilla.org bugzilla.mozilla.org
- ftp.mozilla.org ftp.mozilla.org
- ftp.mozilla.org ftp.mozilla.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- cert-portal.siemens.com cert-portal.siemens.com
- www.starwindsoftware.com www.starwindsoftware.com
- GLSA-202212-05 security.gentoo.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de nss
Les 6 CVE de nss →
CVE-2023-4421
The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks
Non notée
CVE-2019-17007
In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in…
Non notée
CVE-2019-17006
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks
Non notée
CVE-2018-18508
In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a…
Non notée