The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nss | Jul 30, 2024 | Dec 15, 2014 |
| Freebsd | — | Upgrade linux-firefoxUpgrade firefox-esrUpgrade linux-thunderbirdUpgrade nssUpgrade firefoxUpgrade seamonkeyUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade libxul | Dec 10, 2025 | Dec 2, 2014 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Dec 15, 2014 |
| Suse | — | Upgrade mozilla-nssUpgrade mozilla-nss-x86Upgrade libfreebl3Upgrade mozilla-nss-32bitUpgrade mozilla-nss-sysinit-32bitUpgrade MozillaFirefox-develUpgrade mozilla-nss-certsUpgrade mozilla-nss-develUpgrade mozilla-nss-certs-32bitUpgrade libsoftokn3Upgrade libfreebl3-x86Upgrade libsoftokn3-hmac-32bitUpgrade libfreebl3-hmacUpgrade mozilla-nss-sysinitUpgrade libsoftokn3-32bitUpgrade libsoftokn3-hmacUpgrade MozillaFirefox-translationsUpgrade MozillaFirefoxUpgrade mozilla-nss-toolsUpgrade libfreebl3-32bitUpgrade libfreebl3-hmac-32bitUpgrade libsoftokn3-x86 | Dec 18, 2015 | Dec 15, 2014 |
| Ubuntu | — | Upgrade libnss3-1dUpgrade libnss3 | Nov 8, 2024 | Dec 15, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub