CVE-2017-5461 Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-...
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 45.9.0esr-1 | 45.9.0esr-1 |
| debian/firefox-esr(Debian:13) | < 45.9.0esr-1 | 45.9.0esr-1 |
| debian/firefox-esr(Debian:14) | < 45.9.0esr-1 | 45.9.0esr-1 |
| debian/nss(Debian:12) | < 2:3.26.2-1.1 | 2:3.26.2-1.1 |
| debian/nss(Debian:13) | < 2:3.26.2-1.1 | 2:3.26.2-1.1 |
| debian/nss(Debian:14) | < 2:3.26.2-1.1 | 2:3.26.2-1.1 |
| mozilla network security services | < 3.21.4 | 3.21.4 |
| mozilla network security services | >= 3.22, < 3.28.4 | 3.28.4 |
| mozilla network security services | >= 3.29, < 3.29.5 | 3.29.5 |
| mozilla network security services | >= 3.30, < 3.30.1 | 3.30.1 |
| alpine/nss(Alpine:v3.3) | < 3.23-r1 | 3.23-r1 |
| alpine/nss(Alpine:v3.4) | < 3.23-r1 | 3.23-r1 |
| mozilla Thunderbird | < 52.1 | 52.1 |
| mozilla firefox esr | < 45.9 | 45.9 |
| mozilla firefox esr | < 52.1 | 52.1 |
| mozilla Firefox | < 53 | 53 |
References
- Debian Security Tracker CVE-2017-5461 vendor-advisory
- DSA-3831 patch vendor-advisory
- DSA-3872 patch vendor-advisory
- www.oracle.com patch
- www.oracle.com patch
- 98050 third-party-advisory vdb-entry
- 1038320 third-party-advisory vdb-entry
- RHSA-2017:1100 patch vendor-advisory
- RHSA-2017:1101 patch vendor-advisory
- RHSA-2017:1102 patch vendor-advisory
- RHSA-2017:1103 patch vendor-advisory
- bugzilla.mozilla.org issue-tracking permissions-required
- developer.mozilla.org release-notes vendor-advisory
- developer.mozilla.org release-notes vendor-advisory
- developer.mozilla.org release-notes vendor-advisory
- developer.mozilla.org release-notes vendor-advisory
- GLSA-201705-04 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking