Denial Of Service (DoS)

2019-01-1508:54:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.104 Low

EPSS

Percentile

95.0%

JSON

nss is vulnerable to denial of service (DoS) attacks. The vulnerability exists as the ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response.

CPENameOperatorVersion
nspreq4.7.0.99.2__1.el5
nspreq4.8.8__2.el5
nspreq4.6.5__1.0.1.el5
nspreq4.8.8__3.el6
nspreq4.7.3__2.el5
nspreq4.6.5__3.el5
nspreq4.7.6__1.el5_4
nspreq4.8.6__1.el6
nspreq4.7.4__1.el5_3.1
nspreq4.8.9__3.el6_2

Name	Operator	Version
nspr	eq	4.7.0.99.2__1.el5
nspr	eq	4.8.8__2.el5
nspr	eq	4.6.5__1.0.1.el5
nspr	eq	4.8.8__3.el6
nspr	eq	4.7.3__2.el5
nspr	eq	4.6.5__3.el5
nspr	eq	4.7.6__1.el5_4
nspr	eq	4.8.6__1.el6
nspr	eq	4.7.4__1.el5_3.1
nspr	eq	4.8.9__3.el6_2