CVE-2015-7182: Buffer Overflow
First published: Thu Nov 05 2015(Updated: )
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Traffic Director | =11.1.1.7.0 | |
| Oracle Traffic Director | =11.1.1.9.0 | |
| Oracle OpenSSO | =3.0-0.7 | |
| Oracle Iplanet Web Proxy Server | =4.0 | |
| Mozilla Firefox ESR | =38.0 | |
| Mozilla Firefox ESR | =38.0.1 | |
| Mozilla Firefox ESR | =38.0.5 | |
| Mozilla Firefox ESR | =38.1.0 | |
| Mozilla Firefox ESR | =38.1.1 | |
| Mozilla Firefox ESR | =38.2.0 | |
| Mozilla Firefox ESR | =38.2.1 | |
| Mozilla Firefox ESR | =38.3.0 | |
| Oracle GlassFish Server | =2.1.1 | |
| Mozilla Network Security Services | <=3.19.2.0 | |
| Mozilla Network Security Services | =3.20.0 | |
| Oracle iPlanet Web Server | =7.0 | |
| Mozilla Firefox | <=41.0.2 | |
| Mozilla Firefox | =38.0 | |
| Mozilla Firefox | =38.0.1 | |
| Mozilla Firefox | =38.0.5 | |
| Mozilla Firefox | =38.1.0 | |
| Mozilla Firefox | =38.1.1 | |
| Mozilla Firefox | =38.2.0 | |
| Mozilla Firefox | =38.2.1 | |
| Mozilla Firefox | =38.3.0 | |
| IBM Cognos Analytics | <=12.0.0-12.0.3 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
- http://rhn.redhat.com/errata/RHSA-2015-1980.html
- http://rhn.redhat.com/errata/RHSA-2015-1981.html
- http://www.debian.org/security/2015/dsa-3393
- http://www.debian.org/security/2015/dsa-3410
- http://www.debian.org/security/2016/dsa-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/77416
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1034069
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753
- http://www.ubuntu.com/usn/USN-2785-1
- http://www.ubuntu.com/usn/USN-2791-1
- http://www.ubuntu.com/usn/USN-2819-1
- https://bto.bluecoat.com/security-advisory/sa119
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202868
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- https://security.gentoo.org/glsa/201512-10
- https://security.gentoo.org/glsa/201605-06
- https://www.ibm.com/support/pages/node/7177223 (Advisory)
- agent/references
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/ibm-support
- source/IBM
- vendor/oracle
- canonical/oracle traffic director
- version/oracle traffic director/11.1.1.7.0
- version/oracle traffic director/11.1.1.9.0
- canonical/oracle opensso
- version/oracle opensso/3.0-0.7
- canonical/oracle iplanet web proxy server
- version/oracle iplanet web proxy server/4.0
- vendor/mozilla
- canonical/mozilla firefox esr
- version/mozilla firefox esr/38.0
- version/mozilla firefox esr/38.0.1
- version/mozilla firefox esr/38.0.5
- version/mozilla firefox esr/38.1.0
- version/mozilla firefox esr/38.1.1
- version/mozilla firefox esr/38.2.0
- version/mozilla firefox esr/38.2.1
- version/mozilla firefox esr/38.3.0
- canonical/oracle glassfish server
- version/oracle glassfish server/2.1.1
- canonical/mozilla network security services
- version/mozilla network security services/3.19.2.0
- version/mozilla network security services/3.20.0
- canonical/oracle iplanet web server
- version/oracle iplanet web server/7.0
- canonical/mozilla firefox
- version/mozilla firefox/41.0.2
- version/mozilla firefox/38.0
- version/mozilla firefox/38.0.1
- version/mozilla firefox/38.0.5
- version/mozilla firefox/38.1.0
- version/mozilla firefox/38.1.1
- version/mozilla firefox/38.2.0
- version/mozilla firefox/38.2.1
- version/mozilla firefox/38.3.0
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.3
- version/ibm cognos analytics/11.2.0-11.2.4 fp4