Mozilla Foundation Security Advisory 2016-35
Buffer overflow during ASN.1 decoding in NSS
- Announced
- March 8, 2016
- Reporter
- Francis Gabriel
- Impact
- Critical
- Products
- Firefox, Firefox ESR, NSS, Thunderbird
- Fixed in
-
- Firefox 45
- Firefox ESR 38.7
- NSS 3.19.2.3
- NSS 3.21.1
- Thunderbird 38.7
- Thunderbird 45
Description
Security researcher Francis Gabriel of Quarkslab reported a heap-based buffer overflow in the way the Network Security Services (NSS) libraries parsed certain ASN.1 structures. An attacker could create a specially-crafted certificate which, when parsed by NSS, would cause it to crash or execute arbitrary code with the permissions of the user.
This issue has been addressed in the NSS releases shipping on affected Mozilla products:
- Firefox ESR 38.7 has been updated to 3.19.2.3.
- Firefox 45 has been updated to 3.21.1.
Projects using NSS 3.21 should update the new 3.21.1 release.