CVE-2016-2834
HighSummary
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
Risk Assessment
Attackers may exploit this vulnerability to disrupt application functionality, potentially leading to service unavailability for users.
Recommendation
It is recommended to update Mozilla Network Security Services to version 3.23 or later and Mozilla Firefox to version 47.0 or later to mitigate the risk.
Other vulnerabilities in Mozilla Network Security Services (NSS), Mozilla Firefox
See all- CVE-2016-1979High
A use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
- CVE-2016-1978High
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
- CVE-2016-1950High
A heap-based buffer overflow in Mozilla Network Security Services (NSS) before version 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1 allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
Original NVD description (English source)
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.