NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
2021-12-08T22:15:09.163
2024-11-21T06:29:21.467
Modified
CVSSv3.1: 9.8 (CRITICAL)
AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | mozilla | nss | < 3.73 | Yes |
| Application | mozilla | nss_esr | < 3.68.1 | Yes |
| Application | netapp | cloud_backup | - | Yes |
| Application | netapp | e-series_santricity_os_controller | ≤ 11.70.1 | Yes |
| Application | oracle | communications_cloud_native_core_binding_support_function | 1.11.0 | Yes |
| Application | oracle | communications_cloud_native_core_network_repository_function | 1.15.0 | Yes |
| Application | oracle | communications_cloud_native_core_network_repository_function | 1.15.1 | Yes |
| Application | oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 | Yes |
| Application | oracle | communications_policy_management | 12.6.0.0.0 | Yes |
| Application | starwindsoftware | starwind_san_\&_nas | v8r13 | Yes |
| Application | starwindsoftware | starwind_virtual_san | v8r13 | Yes |