CVE-2015-7182 Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and...
CriticalCVSS 9.8
EPSS 10.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nss(Debian:12) | < 2:3.20.1-1 | 2:3.20.1-1 |
| debian/nss(Debian:13) | < 2:3.20.1-1 | 2:3.20.1-1 |
| debian/nss(Debian:14) | < 2:3.20.1-1 | 2:3.20.1-1 |
| oracle traffic director | = 11.1.1.7.0 | No fix listed |
| oracle traffic director | = 11.1.1.9.0 | No fix listed |
| oracle opensso | = 3.0-0.7 | No fix listed |
| oracle iplanet web proxy server | = 4.0 | No fix listed |
| mozilla Firefox | = 38.0 | No fix listed |
| mozilla Firefox | = 38.0.1 | No fix listed |
| mozilla Firefox | = 38.0.5 | No fix listed |
| mozilla Firefox | = 38.1.0 | No fix listed |
| mozilla Firefox | = 38.1.1 | No fix listed |
| mozilla Firefox | = 38.2.0 | No fix listed |
| mozilla Firefox | = 38.2.1 | No fix listed |
| mozilla Firefox | = 38.3.0 | No fix listed |
| mozilla Firefox | <= 41.0.2 | No fix listed |
| oracle glassfish server | = 2.1.1 | No fix listed |
| mozilla network security services | <= 3.19.2.0 | No fix listed |
| mozilla network security services | = 3.20.0 | No fix listed |
| oracle iplanet web server | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-7182 vendor-advisory
- SUSE-SU-2015:1926 vendor-advisory
- openSUSE-SU-2015:1942 vendor-advisory
- SUSE-SU-2015:1978 vendor-advisory
- SUSE-SU-2015:1981 vendor-advisory
- SUSE-SU-2015:2081 vendor-advisory
- openSUSE-SU-2015:2229 vendor-advisory
- openSUSE-SU-2015:2245 vendor-advisory
- packetstormsecurity.com
- RHSA-2015:1980 vendor-advisory
- RHSA-2015:1981 vendor-advisory
- DSA-3393 vendor-advisory
- DSA-3410 vendor-advisory
- DSA-3688 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com patch
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 77416 vdb-entry
- 91787 vdb-entry
- 1034069 vdb-entry
- SSA:2015-310-02 vendor-advisory
- USN-2785-1 vendor-advisory
- USN-2791-1 vendor-advisory
- USN-2819-1 vendor-advisory
- bto.bluecoat.com
- bugzilla.mozilla.org
- developer.mozilla.org vendor-advisory
- developer.mozilla.org vendor-advisory
- developer.mozilla.org vendor-advisory
- GLSA-201512-10 vendor-advisory
- GLSA-201605-06 vendor-advisory