CVE-2016-1978
HighSummary
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
Risk Assessment
Organizations may experience denial of service, potentially leading to service availability interruptions and unspecified security impacts.
Recommendation
It is recommended to update Mozilla Network Security Services (NSS) to version 3.21 or later and Mozilla Firefox to version 44.0 or later to mitigate this vulnerability.
Other vulnerabilities in Mozilla Network Security Services (NSS), Mozilla Firefox
See all- CVE-2016-2834High
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- CVE-2016-1979High
A use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
- CVE-2016-1950High
A heap-based buffer overflow in Mozilla Network Security Services (NSS) before version 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1 allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
Original NVD description (English source)
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.