CVE-2016-1950
HighSummary
A heap-based buffer overflow in Mozilla Network Security Services (NSS) before version 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1 allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data theft.
Recommendation
It is recommended to update to the latest version of Mozilla NSS and Firefox browsers to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Mozilla Network Security Services (NSS), Mozilla Firefox
See all- CVE-2016-2834High
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- CVE-2016-1979High
A use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
- CVE-2016-1978High
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
Original NVD description (English source)
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.