CVE-2016-1950: Buffer Overflow
Published Mar 13, 2016
·Updated
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
Affected Software
48 affected components
All of the following
Any of the following
Mozilla Network Security Services=3.19.2
Mozilla Network Security Services=3.20
Mozilla Network Security Services=3.20.1
Mozilla Network Security Services=3.21
Any of the following
Mozilla Firefox<=44.0.2
Mozilla Firefox=38.0
Mozilla Firefox=38.0.1
Mozilla Firefox=38.0.5
Mozilla Firefox=38.1.0
Mozilla Firefox=38.1.1
Mozilla Firefox=38.2.0
Mozilla Firefox=38.2.1
Mozilla Firefox=38.3.0
Mozilla Firefox=38.4.0
Mozilla Firefox=38.5.0
Mozilla Firefox=38.5.1
Mozilla Firefox=38.6.0
Mozilla Firefox=38.6.1
Oracle Linux=5.0
Oracle Linux=6
Oracle Linux=7
Oracle VM Server=3.2
Apple iPhone OS<=9.2.1
Apple iOS and macOS<=10.11.3
Apple tvOS<=9.1
Apple WatchOS<=2.1
Oracle GlassFish Server=2.1.1
Oracle Iplanet Web Proxy Server=4.0
Oracle iPlanet Web Server=7.0
openSUSE openSUSE=13.1
Mozilla Network Security Services=3.19.2
Mozilla Network Security Services=3.20
Mozilla Network Security Services=3.20.1
Mozilla Network Security Services=3.21
Mozilla Firefox<=44.0.2
Mozilla Firefox ESR=38.0
Mozilla Firefox ESR=38.0.1
Mozilla Firefox ESR=38.0.5
Mozilla Firefox ESR=38.1.0
Mozilla Firefox ESR=38.1.1
Mozilla Firefox ESR=38.2.0
Mozilla Firefox ESR=38.2.1
Mozilla Firefox ESR=38.3.0
Mozilla Firefox ESR=38.4.0
Mozilla Firefox ESR=38.5.0
Mozilla Firefox ESR=38.5.1
Mozilla Firefox ESR=38.6.0
Mozilla Firefox ESR=38.6.1
Event History
Mar 13, 2016
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
Is there an exploit for CVE-2016-1950?
Yes, CVE-2016-1950 has known exploits that target crafted ASN.1 data in X.509 certificates.