The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nss | Jul 30, 2024 | Dec 15, 2014 |
| Freebsd | — | Upgrade linux-firefoxUpgrade firefox-esrUpgrade nssUpgrade linux-thunderbirdUpgrade libxulUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade seamonkey | Dec 10, 2025 | Dec 2, 2014 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Dec 15, 2014 |
| Suse | — | Upgrade mozilla-nss-32bitUpgrade libfreebl3Upgrade mozilla-nss-certsUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nssUpgrade mozilla-nss-develUpgrade mozilla-nss-x86Upgrade MozillaFirefox-develUpgrade MozillaFirefoxUpgrade mozilla-nss-sysinitUpgrade libsoftokn3-hmac-32bitUpgrade libsoftokn3Upgrade libsoftokn3-32bitUpgrade libfreebl3-hmacUpgrade libfreebl3-32bitUpgrade libsoftokn3-x86Upgrade libfreebl3-hmac-32bitUpgrade mozilla-nss-toolsUpgrade libsoftokn3-hmacUpgrade libfreebl3-x86Upgrade mozilla-nss-certs-32bitUpgrade MozillaFirefox-translations | Dec 18, 2015 | Dec 15, 2014 |
| Ubuntu | — | Upgrade libnss3Upgrade libnss3-1d | Nov 8, 2024 | Dec 15, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub