The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nss-pkcs11-develUpgrade nssUpgrade nss-softokn-freebl-develUpgrade nss-develUpgrade nss-util-develUpgrade nss-softoknUpgrade nsprUpgrade nss-sysinitUpgrade nss-toolsUpgrade nss-utilUpgrade nss-softokn-develUpgrade nspr-develUpgrade nss-softokn-freebl | Dec 1, 2016 | Apr 3, 2013 |
| Debian | — | Upgrade nss | Jul 30, 2024 | Apr 3, 2013 |
| Freebsd | — | Upgrade seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade linux-firefox | Dec 10, 2025 | Apr 3, 2013 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox.Upgrade www-client/seamonkey.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird. | Oct 30, 2017 | Apr 3, 2013 |
| Mfsa2013 40 | — | Upgrade to Mozilla Firefox ESR version 17.0.5Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 20.0 | Apr 3, 2013 | Apr 2, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.17.0 | Apr 3, 2013 | Apr 2, 2013 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 17.0.5Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird ESR version 17.0.5 | Apr 3, 2013 | Apr 2, 2013 |
| Oracle_linux | — | Upgrade nss-softokn-freeblUpgrade nspr-develUpgrade nss-softokn-develUpgrade nss-pkcs11-develUpgrade nss-sysinitUpgrade nss-softoknUpgrade nss-util-develUpgrade nss-toolsUpgrade nsprUpgrade nssUpgrade nss-utilUpgrade nss-softokn-freebl-develUpgrade nss-devel | Oct 16, 2024 | Apr 3, 2013 |
| Suse | — | Upgrade mozilla-js-32bitUpgrade libfreebl3-x86Upgrade mozilla-nss-debugsourceUpgrade mozilla-nss-certsUpgrade xulrunner-debuginfoUpgrade libsoftokn3Upgrade mozilla-nss-x86Upgrade mozilla-js-x86Upgrade xulrunner-debugsourceUpgrade enigmailUpgrade libfreebl3-debuginfoUpgrade mozilla-nss-tools-debuginfoUpgrade MozillaThunderbird-translations-commonUpgrade xulrunner-32bitUpgrade mozillafirefox-buildsymbolsUpgrade mozilla-nss-develUpgrade xulrunnerUpgrade mozilla-nss-sysinitUpgrade MozillaFirefox-translations-otherUpgrade enigmail-debuginfoUpgrade xulrunner-debuginfo-x86Upgrade xulrunner-debuginfo-32bitUpgrade mozilla-nss-certs-debuginfo-x86Upgrade MozillaThunderbird-debugsourceUpgrade mozilla-nss-certs-debuginfo-32bitUpgrade mozilla-nss-debuginfo-32bitUpgrade MozillaThunderbird-develUpgrade seamonkey-ircUpgrade MozillaThunderbird-devel-debuginfoUpgrade mozilla-nss-sysinit-debuginfoUpgrade mozilla-js-debuginfo-32bitUpgrade mozilla-nss-toolsUpgrade MozillaThunderbirdUpgrade mozilla-nss-debuginfoUpgrade MozillaFirefox-develUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nss-sysinit-x86Upgrade seamonkey-translations-otherUpgrade mozilla-nss-sysinit-debuginfo-32bitUpgrade mozilla-nss-certs-32bitUpgrade sle-sdk-releaseUpgrade mozilla-nspr-debugsourceUpgrade libsoftokn3-x86Upgrade libfreebl3-32bitUpgrade mozilla-nspr-64bitUpgrade libsoftokn3-debuginfoUpgrade mozilla-nspr-debuginfoUpgrade mozilla-nspr-debuginfo-x86Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nspr-develUpgrade seamonkey-debuginfoUpgrade mozilla-nss-certs-debuginfoUpgrade mozilla-nss-32bitUpgrade mozilla-nspr-x86Upgrade MozillaFirefox-translationsUpgrade mozilla-nsprUpgrade mozilla-nssUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nspr-debuginfo-32bitUpgrade libsoftokn3-debuginfo-x86Upgrade mozilla-jsUpgrade MozillaFirefox-debuginfoUpgrade mozilla-nss-debuginfo-x86Upgrade xulrunner-x86Upgrade MozillaThunderbird-buildsymbolsUpgrade MozillaThunderbird-debuginfoUpgrade seamonkey-dom-inspectorUpgrade seamonkeyUpgrade seamonkey-debugsourceUpgrade mozilla-nss-sysinit-debuginfo-x86Upgrade libsoftokn3-debuginfo-32bitUpgrade mozilla-js-debuginfo-x86Upgrade seamonkey-venkmanUpgrade mozillafirefox-branding-upstreamUpgrade seamonkey-translations-commonUpgrade libfreebl3-debuginfo-x86Upgrade libfreebl3Upgrade mozilla-nss-64bitUpgrade xulrunner-develUpgrade mozilla-nspr-32bitUpgrade MozillaFirefoxUpgrade mozilla-js-debuginfoUpgrade mozilla-nss-certs-x86Upgrade mozilla-nss-sysinit-32bitUpgrade xulrunner-buildsymbolsUpgrade libfreebl3-debuginfo-32bitUpgrade MozillaFirefox-debugsourceUpgrade xulrunner-devel-debuginfoUpgrade libsoftokn3-32bit | Feb 17, 2015 | Apr 3, 2013 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Nov 8, 2024 | Apr 3, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub