CVE-2016-1979
HighSummary
A use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
Risk Assessment
An attacker could exploit this vulnerability to disrupt application functionality or introduce unforeseen effects, potentially leading to service availability loss.
Recommendation
It is recommended to update Mozilla Network Security Services (NSS) to version 3.21.1 or later and Mozilla Firefox to version 45.0 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Mozilla Network Security Services (NSS), Mozilla Firefox
See all- CVE-2016-2834High
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- CVE-2016-1978High
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
- CVE-2016-1950High
A heap-based buffer overflow in Mozilla Network Security Services (NSS) before version 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1 allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
Original NVD description (English source)
Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.