Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nssUpgrade nss-sysinitUpgrade nspr-develUpgrade nsprUpgrade nss-develUpgrade nss-util-develUpgrade nss-utilUpgrade nss-toolsUpgrade nss-pkcs11-devel | Dec 1, 2016 | Jul 23, 2014 |
| Debian | — | Upgrade iceweaselUpgrade icedoveUpgrade nss | Jul 30, 2024 | Jul 23, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 17, 2015 |
| Freebsd | — | Upgrade thunderbirdUpgrade firefoxUpgrade linux-firefoxUpgrade nssUpgrade linux-thunderbirdUpgrade firefox-esr | Dec 10, 2025 | Jul 23, 2014 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox.Upgrade mail-client/thunderbird.Upgrade dev-libs/nspr.Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey. | Oct 30, 2017 | Jul 23, 2014 |
| Mfsa2014 63 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 24.7Upgrade to Mozilla Firefox version 31.0 | Jul 28, 2014 | Jul 23, 2014 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 31.0Upgrade to Mozilla Thunderbird version 24.7Upgrade to the latest version of Mozilla Thunderbird | Jul 28, 2014 | Jul 23, 2014 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Jul 23, 2014 |
| Oracle_linux | — | Upgrade nss-utilUpgrade nss-develUpgrade nss-sysinitUpgrade nsprUpgrade nss-util-develUpgrade nss-toolsUpgrade nspr-develUpgrade nss-pkcs11-develUpgrade nss | Oct 16, 2024 | Jul 23, 2014 |
| Suse | — | Upgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbirdUpgrade libfreebl3-x86Upgrade MozillaThunderbird-develUpgrade MozillaFirefox-develUpgrade libfreebl3Upgrade mozilla-nssUpgrade libsoftokn3-x86Upgrade mozilla-nss-toolsUpgrade mozilla-nss-32bitUpgrade MozillaFirefoxUpgrade mozilla-nss-x86Upgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translationsUpgrade mozilla-nss-develUpgrade libsoftokn3-32bitUpgrade libsoftokn3Upgrade libfreebl3-32bitUpgrade MozillaThunderbird-translations-common | Dec 18, 2015 | Jul 23, 2014 |
| Ubuntu | — | Upgrade libnss3Upgrade firefoxUpgrade thunderbirdUpgrade libnss3-1d | Nov 8, 2024 | Jul 23, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub