Mozilla Network_security_services
50 CVEs affecting Mozilla Network_security_services. Latest disclosed: 2022-10-14. Critical: 3, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17006 | Critical | 9.8 | 2020-10-22 | In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library… |
CVE-2017-5461 | Critical | 9.8 | 2017-05-11 | Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attack… |
CVE-2015-7182 | Critical | 9.8 | 2015-11-05 | Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before… |
CVE-2016-2834 | High | 8.8 | 2016-06-13 | Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corru… |
CVE-2016-1979 | High | 8.8 | 2016-03-13 | Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozi… |
CVE-2016-1950 | High | 8.8 | 2016-03-13 | Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45… |
CVE-2017-11698 | High | 7.8 | 2017-12-27 | Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to… |
CVE-2017-11697 | High | 7.8 | 2017-12-27 | The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating poi… |
CVE-2017-11696 | High | 7.8 | 2017-12-27 | Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to h… |
CVE-2017-11695 | High | 7.8 | 2017-12-27 | Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to ha… |
CVE-2022-3479 | High | 7.5 | 2022-10-14 | A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmen… |
CVE-2019-17007 | High | 7.5 | 2020-10-22 | In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service. |
CVE-2020-25648 | High | 7.5 | 2020-10-20 | A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a… |
CVE-2017-7502 | High | 7.5 | 2017-05-30 | Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attac… |
CVE-2016-1978 | High | 7.3 | 2016-03-13 | Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefo… |
CVE-2018-18508 | Medium | 6.5 | 2020-10-22 | In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of… |
CVE-2018-12404 | Medium | 5.9 | 2019-05-02 | A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chos… |
CVE-2018-12384 | Medium | 5.9 | 2019-04-29 | When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full… |
CVE-2016-9574 | Medium | 5.9 | 2018-07-19 | nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA. |
CVE-2015-7575 | Medium | 5.9 | 2016-01-09 | Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatu… |