CVE-2016-1950 Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allo...
HighCVSS 8.8
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 45.0esr-1 | 45.0esr-1 |
| debian/firefox-esr(Debian:13) | < 45.0esr-1 | 45.0esr-1 |
| debian/firefox-esr(Debian:14) | < 45.0esr-1 | 45.0esr-1 |
| debian/nss(Debian:12) | < 2:3.23-1 | 2:3.23-1 |
| debian/nss(Debian:13) | < 2:3.23-1 | 2:3.23-1 |
| debian/nss(Debian:14) | < 2:3.23-1 | 2:3.23-1 |
| mozilla network security services | = 3.19.2 | No fix listed |
| mozilla network security services | = 3.20 | No fix listed |
| mozilla network security services | = 3.20.1 | No fix listed |
| mozilla network security services | = 3.21 | No fix listed |
| mozilla Firefox | <= 44.0.2 | No fix listed |
| mozilla Firefox | = 38.0 | No fix listed |
| mozilla Firefox | = 38.0.1 | No fix listed |
| mozilla Firefox | = 38.0.5 | No fix listed |
| mozilla Firefox | = 38.1.0 | No fix listed |
| mozilla Firefox | = 38.1.1 | No fix listed |
| mozilla Firefox | = 38.2.0 | No fix listed |
| mozilla Firefox | = 38.2.1 | No fix listed |
| mozilla Firefox | = 38.3.0 | No fix listed |
| mozilla Firefox | = 38.4.0 | No fix listed |
| mozilla Firefox | = 38.5.0 | No fix listed |
| mozilla Firefox | = 38.5.1 | No fix listed |
| mozilla Firefox | = 38.6.0 | No fix listed |
| mozilla Firefox | = 38.6.1 | No fix listed |
| oracle linux | = 5.0 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| oracle vm server | = 3.2 | No fix listed |
| apple iphone os | <= 9.2.1 | No fix listed |
| apple mac os x | <= 10.11.3 | No fix listed |
| apple tvOS | <= 9.1 | No fix listed |
| apple watchOS | <= 2.1 | No fix listed |
| oracle glassfish server | = 2.1.1 | No fix listed |
| oracle iplanet web proxy server | = 4.0 | No fix listed |
| oracle iplanet web server | = 7.0 | No fix listed |
| opensuse | = 13.1 | No fix listed |
References
- Debian Security Tracker CVE-2016-1950 vendor-advisory
- APPLE-SA-2016-03-21-1 mailing-list vendor-advisory
- APPLE-SA-2016-03-21-2 mailing-list vendor-advisory
- APPLE-SA-2016-03-21-3 mailing-list vendor-advisory
- APPLE-SA-2016-03-21-5 mailing-list vendor-advisory
- SUSE-SU-2016:0727 vendor-advisory
- openSUSE-SU-2016:0731 vendor-advisory
- openSUSE-SU-2016:0733 vendor-advisory
- SUSE-SU-2016:0777 vendor-advisory
- SUSE-SU-2016:0820 vendor-advisory
- SUSE-SU-2016:0909 vendor-advisory
- openSUSE-SU-2016:1557 third-party-advisory vendor-advisory
- RHSA-2016:0495 vendor-advisory
- DSA-3510 vendor-advisory
- DSA-3520 vendor-advisory
- DSA-3688 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- www.oracle.com third-party-advisory
- www.oracle.com
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 84223 vdb-entry
- 1035215 vdb-entry
- USN-2917-1 vendor-advisory
- USN-2917-2 vendor-advisory
- USN-2917-3 vendor-advisory
- USN-2924-1 vendor-advisory
- USN-2934-1 vendor-advisory
- bto.bluecoat.com
- bugzilla.mozilla.org issue-tracking
- developer.mozilla.org release-notes
- developer.mozilla.org release-notes
- GLSA-201605-06 vendor-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory