Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nss | Jul 30, 2024 | Oct 28, 2011 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/mozilla-firefox.Upgrade mail-client/thunderbird-bin.Upgrade dev-libs/nss.Upgrade www-client/seamonkey-bin.Upgrade net-libs/xulrunner.Upgrade www-client/icecat.Upgrade mail-client/mozilla-thunderbird.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey. | Oct 30, 2017 | Oct 27, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 23, 2011 |
| Suse | — | Upgrade libfreebl3-32bitUpgrade libsoftokn3-hmac-32bitUpgrade libfreebl3-hmacUpgrade libfreebl3-hmac-32bitUpgrade libsoftokn3-hmacUpgrade mozilla-nss-32bitUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-certsUpgrade mozilla-nss-sysinitUpgrade libsoftokn3-32bitUpgrade libsoftokn3Upgrade mozilla-nssUpgrade mozilla-nss-develUpgrade mozilla-nss-toolsUpgrade libfreebl3Upgrade mozilla-nss-sysinit-32bit | Feb 17, 2015 | Jun 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub