PT-2016-1438 · Mozilla+4 · Network Security Services+5
Tim Taubert
+1
·
Publicado
2016-03-08
·
Atualizado
2024-12-12
·
CVE-2016-1979
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Network Security Services (NSS) versions prior to 3.21.1
Mozilla Firefox versions prior to 45.0
Description
The issue is related to a use-after-free vulnerability in the
PK11 ImportDERPrivateKeyInfoAndReturnKey function. This vulnerability can be exploited by a remote attacker using specially crafted key data with DER encoding, potentially leading to a denial of service or other unspecified impacts.Recommendations
For Network Security Services (NSS) versions prior to 3.21.1, update to version 3.21.1 or later.
For Mozilla Firefox versions prior to 45.0, update to version 45.0 or later.
As a temporary workaround, consider restricting the use of the
PK11 ImportDERPrivateKeyInfoAndReturnKey function until a patch is available.Correção
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Firefox
Network Security Services
Red Hat
Suse
Ubuntu