Out-of-Bounds Affecting nss package, versions <2:3.23-1
Threat Intelligence
EPSS
1.01% (84th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN10-NSS-421276
- published 13 Mar 2016
- disclosed 13 Mar 2016
Introduced: 13 Mar 2016
CVE-2016-1950 Open this link in a new tabHow to fix?
Upgrade Debian:10 nss to version 2:3.23-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream nss package and not the nss package as distributed by Debian.
See How to fix? for Debian:10 relevant fixed versions and status.
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
References
- https://security-tracker.debian.org/tracker/CVE-2016-1950
- https://support.apple.com/HT206166
- https://support.apple.com/HT206167
- https://support.apple.com/HT206168
- https://support.apple.com/HT206169
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
- https://bto.bluecoat.com/security-advisory/sa119
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.3_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21.1_release_notes
- http://www.debian.org/security/2016/dsa-3510
- http://www.debian.org/security/2016/dsa-3520
- http://www.debian.org/security/2016/dsa-3688
- https://security.gentoo.org/glsa/201605-06
- http://www.mozilla.org/security/announce/2016/mfsa2016-35.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1245528
- http://rhn.redhat.com/errata/RHSA-2016-0495.html
- http://www.securityfocus.com/bid/84223
- http://www.securitytracker.com/id/1035215
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-1950
- http://www.ubuntu.com/usn/USN-2917-1
- http://www.ubuntu.com/usn/USN-2917-2
- http://www.ubuntu.com/usn/USN-2917-3
- http://www.ubuntu.com/usn/USN-2924-1
- http://www.ubuntu.com/usn/USN-2934-1
CVSS Scores
version 3.1