Franziskus Kiefer

**Name of the Vulnerable Software and Affected Versions** Network Security Services (NSS) library versions prior to 3.28.4 Firefox ESR versions prior to 52.1 Firefox ESR versions prior to 45.9 Firefox versions prior to 53 Thunderbird versions prior to 52.1 **Description** A flaw in the DRBG number generation within the Network Security Services (NSS) library affects the internal state V, which does not correctly carry bits over. This issue may allow a remote attacker to impact data integrity. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For Network Security Services (NSS) library versions prior to 3.28.4, update to version 3.28.4 or later. For Firefox ESR versions prior to 52.1, update to version 52.1 or later. For Firefox ESR versions prior to 45.9, update to version 45.9 or later. For Firefox versions prior to 53, update to version 53 or later. For Thunderbird versions prior to 52.1, update to version 52.1 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 50 Firefox ESR versions prior to 45.5 Thunderbird versions prior to 45.5 **Description** The issue arises from an insufficient existing mitigation of timing side-channel attacks. This can be exploited under certain circumstances. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For Firefox versions prior to 50, update to version 50 or later. For Firefox ESR versions prior to 45.5, update to version 45.5 or later. For Thunderbird versions prior to 45.5, update to version 45.5 or later.