The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nss | Jul 30, 2024 | Dec 15, 2014 |
| Freebsd | — | Upgrade libxulUpgrade thunderbirdUpgrade firefoxUpgrade seamonkeyUpgrade linux-seamonkeyUpgrade firefox-esrUpgrade nssUpgrade linux-thunderbirdUpgrade linux-firefox | Dec 10, 2025 | Dec 2, 2014 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Dec 15, 2014 |
| Suse | — | Upgrade mozilla-nss-32bitUpgrade mozilla-nssUpgrade mozilla-nss-develUpgrade MozillaFirefox-develUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nss-x86Upgrade mozilla-nss-certsUpgrade libfreebl3Upgrade MozillaFirefoxUpgrade libsoftokn3-hmac-32bitUpgrade libfreebl3-32bitUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-toolsUpgrade mozilla-nss-sysinitUpgrade libfreebl3-hmac-32bitUpgrade libsoftokn3-x86Upgrade libfreebl3-hmacUpgrade libsoftokn3Upgrade libsoftokn3-hmacUpgrade libfreebl3-x86Upgrade MozillaFirefox-translationsUpgrade libsoftokn3-32bit | Dec 18, 2015 | Dec 15, 2014 |
| Ubuntu | — | Upgrade libnss3Upgrade libnss3-1d | Nov 8, 2024 | Dec 15, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub