Fraser Tweedale

Name of the Vulnerable Software and Affected Versions: pki-core (affected versions not specified) Description: A flaw was found in pki-core, allowing an attacker who has successfully compromised a key to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 55 Firefox ESR versions prior to 52.3 Thunderbird versions prior to 52.3 **Description** The issue is caused by a buffer overflow in memory when viewing a certificate in the certificate manager. This can be triggered by a certificate with an extremely long object identifier (OID). Exploitation of this issue may allow a remote attacker to cause a denial of service using a certificate with a specially crafted `OID` identifier. **Recommendations** For Firefox versions prior to 55, update to version 55 or later to resolve the issue. For Firefox ESR versions prior to 52.3, update to version 52.3 or later to resolve the issue. For Thunderbird versions prior to 52.3, update to version 52.3 or later to resolve the issue.