Mozilla Foundation Security Advisory 2012-39
NSS parsing errors with zero length items
- Announced
- June 5, 2012
- Reporter
- Kaspar Brand
- Impact
- Moderate
- Products
- Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
- Fixed in
-
- Firefox 13
- Firefox ESR 10.0.5
- SeaMonkey 2.10
- Thunderbird 13
- Thunderbird ESR 10.0.5
Description
Security researcher Kaspar Brand found a flaw in how the Network Security Services (NSS) ASN.1 decoder handles zero length items. Effects of this issue depend on the field. One known symptom is an unexploitable crash in handling OCSP responses. NSS also mishandles zero-length basic constraints, assuming default values for some types that should be rejected as malformed. These issues have been addressed in NSS 3.13.4, which is now being used by Mozilla.