CVE-2015-7181 The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other product...
HighCVSS 7.5
EPSS 6.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nss(Debian:12) | < 2:3.20.1-1 | 2:3.20.1-1 |
| debian/nss(Debian:13) | < 2:3.20.1-1 | 2:3.20.1-1 |
| debian/nss(Debian:14) | < 2:3.20.1-1 | 2:3.20.1-1 |
| mozilla network security services | <= 3.19.2.0 | No fix listed |
| mozilla network security services | = 3.20.0 | No fix listed |
| mozilla Firefox | <= 41.0.2 | No fix listed |
| mozilla Firefox | = 38.0 | No fix listed |
| mozilla Firefox | = 38.0.1 | No fix listed |
| mozilla Firefox | = 38.0.5 | No fix listed |
| mozilla Firefox | = 38.1.0 | No fix listed |
| mozilla Firefox | = 38.1.1 | No fix listed |
| mozilla Firefox | = 38.2.0 | No fix listed |
| mozilla Firefox | = 38.2.1 | No fix listed |
| mozilla Firefox | = 38.3.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-7181 vendor-advisory
- SUSE-SU-2015:1926 vendor-advisory
- openSUSE-SU-2015:1942 vendor-advisory
- SUSE-SU-2015:1978 vendor-advisory
- SUSE-SU-2015:1981 vendor-advisory
- SUSE-SU-2015:2081 vendor-advisory
- openSUSE-SU-2015:2229 vendor-advisory
- openSUSE-SU-2015:2245 vendor-advisory
- packetstormsecurity.com
- RHSA-2015:1980 vendor-advisory
- RHSA-2015:1981 vendor-advisory
- DSA-3393 vendor-advisory
- DSA-3410 vendor-advisory
- DSA-3688 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 77416 vdb-entry
- 91787 vdb-entry
- 1034069 vdb-entry
- SSA:2015-310-02 vendor-advisory
- USN-2785-1 vendor-advisory
- USN-2791-1 vendor-advisory
- USN-2819-1 vendor-advisory
- bto.bluecoat.com
- bugzilla.mozilla.org
- developer.mozilla.org vendor-advisory
- developer.mozilla.org vendor-advisory
- developer.mozilla.org vendor-advisory
- GLSA-201512-10 vendor-advisory
- GLSA-201605-06 vendor-advisory