kritisch
CVE-2015-7182
nss: ASN.1 decoder heap overflow when decoding constructed OCTET STRING that mixes indefinite and definite length encodings (MFSA 2015-133)
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Red Hat, Amazon, Oracle. Niedriger laut Ubuntu (mittel).
Beschreibung
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | jss, jss-debuginfo, jss-javadoc und 12 weitere | 4.2.6-35.17.amzn1 und 3 weitere |
| Oracle Linux 5 | nspr, nspr-devel, nss und 3 weitere | 4.10.8-2.el5_11 und 1 weitere |
| Oracle Linux 6 | nspr, nspr-devel, nss und 6 weitere | 4.10.8-2.el6_7 und 2 weitere |
| Oracle Linux 7 | nspr, nspr-devel, nss und 6 weitere | 4.10.8-2.el7_1 und 2 weitere |
| debian 11 | nss | 2:3.20.1-1 |
| debian 12 | nss | 2:3.20.1-1 |
| debian 13 | nss | 2:3.20.1-1 |
| debian 14 | nss | 2:3.20.1-1 |
| debian 7 | icedove, iceweasel, nss | 38.4.0-1~deb7u1 und 2 weitere |
| debian 8 | icedove, iceweasel, nss | 38.4.0-1~deb8u1 und 2 weitere |
| echo | nss | 2:3.20.1-1 |
| root.io debian 11 | rootio-nss | 2:3.20.1-1 |
Alle 66 Einträge aus 19 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | jss | 4.2.6-35.17.amzn1 |
| amazon linux 1 | jss-debuginfo | 4.2.6-35.17.amzn1 |
| amazon linux 1 | jss-javadoc | 4.2.6-35.17.amzn1 |
| amazon linux 1 | nspr | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nspr-debuginfo | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nspr-devel | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nss | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-debuginfo | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-devel | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-pkcs11-devel | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-sysinit | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-tools | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-util | 3.19.1-4.47.amzn1 |
| amazon linux 1 | nss-util-debuginfo | 3.19.1-4.47.amzn1 |
| amazon linux 1 | nss-util-devel | 3.19.1-4.47.amzn1 |
| Oracle Linux 5 | nspr | 4.10.8-2.el5_11 |
| Oracle Linux 5 | nspr-devel | 4.10.8-2.el5_11 |
| Oracle Linux 5 | nss | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-devel | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-pkcs11-devel | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-tools | 3.19.1-2.el5_11 |
| Oracle Linux 6 | nspr | 4.10.8-2.el6_7 |
| Oracle Linux 6 | nspr-devel | 4.10.8-2.el6_7 |
| Oracle Linux 6 | nss | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-devel | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-pkcs11-devel | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-sysinit | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-tools | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-util | 3.19.1-2.el6_7 |
| Oracle Linux 6 | nss-util-devel | 3.19.1-2.el6_7 |
| Oracle Linux 7 | nspr | 4.10.8-2.el7_1 |
| Oracle Linux 7 | nspr-devel | 4.10.8-2.el7_1 |
| Oracle Linux 7 | nss | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-devel | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-pkcs11-devel | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-sysinit | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-tools | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-util | 3.19.1-4.el7_1 |
| Oracle Linux 7 | nss-util-devel | 3.19.1-4.el7_1 |
| debian 11 | nss | 2:3.20.1-1 |
| debian 12 | nss | 2:3.20.1-1 |
| debian 13 | nss | 2:3.20.1-1 |
| debian 14 | nss | 2:3.20.1-1 |
| debian 7 | icedove | 38.4.0-1~deb7u1 |
| debian 7 | iceweasel | 38.4.0esr-1~deb7u1 |
| debian 7 | nss | 2:3.14.5-1+deb7u6 |
| debian 8 | icedove | 38.4.0-1~deb8u1 |
| debian 8 | iceweasel | 38.4.0esr-1~deb8u1 |
| debian 8 | nss | 2:3.26-1+debu8u1 |
| echo | nss | 2:3.20.1-1 |
| root.io debian 11 | rootio-nss | 2:3.20.1-1 |
| root.io debian 12 | rootio-nss | 2:3.20.1-1 |
| root.io debian 13 | rootio-nss | 2:3.20.1-1 |
| ubuntu 12.04 | firefox | 42.0+build2-0ubuntu0.12.04.1 |
| ubuntu 12.04 | nss | 3.19.2.1-0ubuntu0.12.04.1 |
| ubuntu 12.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.12.04.1 |
| ubuntu 14.04 | firefox | 42.0+build2-0ubuntu0.14.04.1 |
| ubuntu 14.04 | nss | 2:3.19.2.1-0ubuntu0.14.04.1 |
| ubuntu 14.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.14.04.1 |
| ubuntu 14.04-ESM | nss | 2:3.19.2.1-0ubuntu0.14.04.1 |
| ubuntu 15.04 | firefox | 42.0+build2-0ubuntu0.15.04.1 |
| ubuntu 15.04 | nss | 2:3.19.2.1-0ubuntu0.15.04.1 |
| ubuntu 15.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.15.04.1 |
| ubuntu 15.10 | firefox | 42.0+build2-0ubuntu0.15.10.1 |
| ubuntu 15.10 | nss | 2:3.19.2.1-0ubuntu0.15.10.1 |
| ubuntu 15.10 | thunderbird | 1:38.4.0+build3-0ubuntu0.15.10.1 |
Referenzen
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
Alle 45 Referenzen
- http://rhn.redhat.com/errata/RHSA-2015-1980.html
- http://rhn.redhat.com/errata/RHSA-2015-1981.html
- http://www.debian.org/security/2015/dsa-3393
- http://www.debian.org/security/2015/dsa-3410
- http://www.debian.org/security/2016/dsa-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/77416
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1034069
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753
- http://www.ubuntu.com/usn/USN-2785-1
- http://www.ubuntu.com/usn/USN-2791-1
- http://www.ubuntu.com/usn/USN-2819-1
- https://access.redhat.com/articles/2043623
- https://access.redhat.com/security/cve/CVE-2015-7182
- https://bto.bluecoat.com/security-advisory/sa119
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202868
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- https://linux.oracle.com/cve/CVE-2015-7182.html
- https://linux.oracle.com/errata/ELSA-2015-1981.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-7182
- https://security.gentoo.org/glsa/201512-10
- https://security.gentoo.org/glsa/201605-06
- https://ubuntu.com/security/notices/USN-2785-1
- https://ubuntu.com/security/notices/USN-2791-1
- https://ubuntu.com/security/notices/USN-2819-1
- https://www.cve.org/CVERecord?id=CVE-2015-7182
- https://www.mozilla.org/en-US/security/advisories/mfsa2015-133/
- https://www.mozilla.org/security/announce/2015/mfsa2015-133.html