CVE-2017-5461: Critical severity IBM Cognos Analytics vulnerability
An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461
Acknowledgements:
Name: the Mozilla project Upstream: Ronald Crane
Other sources
An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.
— Mozilla
An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 45.9 has been updated with NSS version 3.21.4.
— Mozilla
An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4.
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by an out-ouf-bounds write during Base64 decoding operation in the Network Security Services (NSS) library. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability using unknown attack vectors to execute arbitrary code on the vulnerable system or cause a denial of service.
— IBM
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 52.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 53 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 52.1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 45.9 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 137.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.9.0esr-1~deb12u1Fixed in 128.8.0esr-1Fixed in 128.9.0esr-2 - Upgrade
Upgrade
debian/nssto a version that resolves this vulnerability.Fixed in 2:3.61-1+deb11u3Fixed in 2:3.61-1+deb11u4Fixed in 2:3.87.1-1+deb12u1Fixed in 2:3.109-1Fixed in 2:3.110-1 - Upgrade
Upgrade
Mozilla Network Security Services (NSS)to a version that resolves this vulnerability.Fixed in 3.21.4 - Upgrade
Upgrade
Mozilla Network Security Services (NSS)to a version that resolves this vulnerability.Fixed in 3.28.4 - Upgrade
Upgrade
Mozilla Network Security Services (NSS)to a version that resolves this vulnerability.Fixed in 3.29.5 - Upgrade
Upgrade
Mozilla Network Security Services (NSS)to a version that resolves this vulnerability.Fixed in 3.30.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5433
- CVE-2017-5435
- CVE-2017-5436
- CVE-2017-5461
- CVE-2017-5459
- CVE-2017-5466
- CVE-2017-5434
- CVE-2017-5432
- CVE-2017-5460
- CVE-2017-5438
- CVE-2017-5439
- CVE-2017-5440
- CVE-2017-5441
- CVE-2017-5442
- CVE-2017-5464
- CVE-2017-5443
- CVE-2017-5444
- CVE-2017-5446
- CVE-2017-5447
- CVE-2017-5465
- CVE-2016-10196
- CVE-2017-5454
- CVE-2017-5469
- CVE-2017-5445
- CVE-2017-5449
- CVE-2017-5451
- CVE-2017-5462
- CVE-2017-5467
- CVE-2017-5430
- CVE-2017-5429
- CVE-2017-5448
- CVE-2017-5455
- CVE-2017-5456
- CVE-2017-5450
- CVE-2017-5463
- CVE-2017-5452
- CVE-2017-5453
- CVE-2017-5458
- CVE-2017-5468
Frequently Asked Questions
What is the severity of CVE-2017-5461?
CVE-2017-5461 has been classified as a critical vulnerability due to its potential for causing exploitable crashes.
How do I fix CVE-2017-5461?
To mitigate CVE-2017-5461, update affected software such as Thunderbird and Firefox to the latest versions as specified in their release notes.
Which software is affected by CVE-2017-5461?
CVE-2017-5461 affects several Mozilla products including Thunderbird, Firefox ESR, and various versions of NSS.
What kind of vulnerability is CVE-2017-5461?
CVE-2017-5461 is an out-of-bounds write vulnerability occurring during Base64 decoding operations.
Can CVE-2017-5461 be exploited remotely?
Yes, the vulnerability in CVE-2017-5461 can potentially be exploited remotely, leading to application crashes.