The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a "use-after-poison" issue.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nss | Aug 30, 2017 | Nov 5, 2015 |
| Centos_linux | — | Upgrade nss-pkcs11-develUpgrade nss-util-develUpgrade nss-utilUpgrade nss-toolsUpgrade nss-sysinitUpgrade nsprUpgrade nspr-develUpgrade nss-develUpgrade nss | Dec 1, 2016 | Nov 5, 2015 |
| Debian | — | Upgrade nssUpgrade icedoveUpgrade iceweasel | Nov 9, 2015 | Nov 5, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Dec 9, 2015 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade linux-c6-nsprUpgrade nssUpgrade libxulUpgrade linux-firefoxUpgrade seamonkeyUpgrade nsprUpgrade thunderbirdUpgrade linux-seamonkeyUpgrade firefox-esrUpgrade firefox | Dec 10, 2025 | Nov 19, 2015 |
| Gentoo Linux | — | Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade dev-libs/nss.Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird.Upgrade dev-libs/nspr. | Oct 30, 2017 | Nov 5, 2015 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Jul 28, 2026 | Oct 13, 2015 |
| Mfsa2015 133 | — | Upgrade to Mozilla Firefox ESR version 38.4Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 42.0 | Nov 4, 2015 | Nov 3, 2015 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 38.4Upgrade to the latest version of Mozilla Thunderbird | Nov 30, 2015 | Nov 5, 2015 |
| Oracle Solaris | — | Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade mail/thunderbird to version 45.3.0-0.175.3.14.0.4.0 on Solaris 11.3Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 45.3.0-0.175.3.14.0.4.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade developer/yasm to version 1.3.0-0.175.3.14.0.2.0 on Solaris 11.3 | May 29, 2017 | Nov 5, 2015 |
| Oracle_linux | — | Upgrade nss-sysinitUpgrade nss-develUpgrade nss-utilUpgrade nss-pkcs11-develUpgrade nssUpgrade nss-util-develUpgrade nspr-develUpgrade nsprUpgrade nss-tools | Oct 16, 2024 | Nov 5, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 3, 2015 |
| Suse | — | Upgrade libsoftokn3-hmac-32bitUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-develUpgrade libsoftokn3Upgrade MozillaFirefox-translations-otherUpgrade libfreebl3-hmac-32bitUpgrade mozilla-nss-certsUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-develUpgrade libfreebl3-x86Upgrade libsoftokn3-hmacUpgrade mozilla-nss-toolsUpgrade MozillaFirefox-develUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nssUpgrade mozilla-nss-sysinitUpgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbird-translations-otherUpgrade libsoftokn3-x86Upgrade mozilla-nss-x86Upgrade MozillaFirefox-translationsUpgrade mozilla-nsprUpgrade libfreebl3-hmacUpgrade MozillaFirefox-translations-commonUpgrade mozillafirefox-branding-sleUpgrade libfreebl3Upgrade libsoftokn3-32bitUpgrade mozilla-nspr-develUpgrade mozilla-nss-32bitUpgrade mozilla-nspr-x86Upgrade libfreebl3-32bitUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nspr-32bitUpgrade MozillaFirefox | Dec 18, 2015 | Nov 5, 2015 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbirdUpgrade libnss3 | Nov 9, 2015 | Nov 5, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub