Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nss | Aug 30, 2017 | Nov 5, 2015 |
| Centos_linux | — | Upgrade nss-pkcs11-develUpgrade nss-util-develUpgrade nsprUpgrade nspr-develUpgrade nss-sysinitUpgrade nss-develUpgrade nss-toolsUpgrade nssUpgrade nss-util | Dec 1, 2016 | Nov 5, 2015 |
| Debian | — | Upgrade nssUpgrade icedoveUpgrade iceweasel | Nov 9, 2015 | Nov 5, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Dec 9, 2015 |
| Freebsd | — | Upgrade thunderbirdUpgrade firefoxUpgrade linux-firefoxUpgrade seamonkeyUpgrade libxulUpgrade nssUpgrade linux-thunderbirdUpgrade nsprUpgrade firefox-esrUpgrade linux-seamonkeyUpgrade linux-c6-nspr | Dec 10, 2025 | Nov 19, 2015 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade dev-libs/nss.Upgrade www-client/firefox.Upgrade dev-libs/nspr.Upgrade mail-client/thunderbird.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Nov 5, 2015 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Jul 28, 2026 | Oct 13, 2015 |
| Mfsa2015 133 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 38.4Upgrade to Mozilla Firefox version 42.0 | Nov 4, 2015 | Nov 3, 2015 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 38.4Upgrade to the latest version of Mozilla Thunderbird | Nov 30, 2015 | Nov 5, 2015 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade developer/yasm to version 1.3.0-0.175.3.14.0.2.0 on Solaris 11.3Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 45.3.0-0.175.3.14.0.4.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade mail/thunderbird to version 45.3.0-0.175.3.14.0.4.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Nov 5, 2015 |
| Oracle_linux | — | Upgrade nss-util-develUpgrade nss-toolsUpgrade nss-pkcs11-develUpgrade nssUpgrade nspr-develUpgrade nsprUpgrade nss-utilUpgrade nss-develUpgrade nss-sysinit | Oct 16, 2024 | Nov 5, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 3, 2015 |
| Suse | — | Upgrade MozillaThunderbird-translations-otherUpgrade libfreebl3-hmac-32bitUpgrade mozilla-nspr-develUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefoxUpgrade MozillaFirefox-develUpgrade mozilla-nss-sysinitUpgrade MozillaFirefox-translations-commonUpgrade libsoftokn3-hmac-32bitUpgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbirdUpgrade libfreebl3-hmacUpgrade libsoftokn3-32bitUpgrade mozillafirefox-branding-sleUpgrade MozillaFirefox-translationsUpgrade libsoftokn3Upgrade libsoftokn3-x86Upgrade mozilla-nss-toolsUpgrade libsoftokn3-hmacUpgrade libfreebl3-32bitUpgrade mozilla-nspr-x86Upgrade mozilla-nss-develUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nssUpgrade mozilla-nss-certsUpgrade mozilla-nsprUpgrade libfreebl3-x86Upgrade mozilla-nss-32bitUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-x86Upgrade mozilla-nss-certs-32bitUpgrade MozillaThunderbird-develUpgrade libfreebl3Upgrade MozillaFirefox-branding-SLED | Dec 18, 2015 | Nov 5, 2015 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbirdUpgrade libnss3 | Nov 9, 2015 | Nov 5, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub