CVE-2015-7182

Critical

Published: 05/11/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1 can lead to application crashes or potentially allow remote attackers to execute arbitrary code via crafted OCTET STRING data.

Risk Assessment

Remote attackers may cause denial of service or gain the ability to execute arbitrary code, posing a significant security threat to systems using vulnerable software versions.

Recommendation

It is recommended to update Mozilla Network Security Services to the latest version to mitigate this vulnerability and reduce the risk of attacks.

Original NVD description (English source)

Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.