critique
CVE-2015-7182
nss: ASN.1 decoder heap overflow when decoding constructed OCTET STRING that mixes indefinite and definite length encodings (MFSA 2015-133)
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Le label propre à Trivy est CRITICAL. Critique selon NVD, Red Hat, Amazon, Oracle. Plus basse selon Ubuntu (moyenne).
Description
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | jss, jss-debuginfo, jss-javadoc et 12 autres | 4.2.6-35.17.amzn1 et 3 autres |
| Oracle Linux 5 | nspr, nspr-devel, nss et 3 autres | 4.10.8-2.el5_11 et 1 autres |
| Oracle Linux 6 | nspr, nspr-devel, nss et 6 autres | 4.10.8-2.el6_7 et 2 autres |
| Oracle Linux 7 | nspr, nspr-devel, nss et 6 autres | 4.10.8-2.el7_1 et 2 autres |
| debian 11 | nss | 2:3.20.1-1 |
| debian 12 | nss | 2:3.20.1-1 |
| debian 13 | nss | 2:3.20.1-1 |
| debian 14 | nss | 2:3.20.1-1 |
| debian 7 | icedove, iceweasel, nss | 38.4.0-1~deb7u1 et 2 autres |
| debian 8 | icedove, iceweasel, nss | 38.4.0-1~deb8u1 et 2 autres |
| echo | nss | 2:3.20.1-1 |
| root.io debian 11 | rootio-nss | 2:3.20.1-1 |
Afficher les 66 entrées de 19 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | jss | 4.2.6-35.17.amzn1 |
| amazon linux 1 | jss-debuginfo | 4.2.6-35.17.amzn1 |
| amazon linux 1 | jss-javadoc | 4.2.6-35.17.amzn1 |
| amazon linux 1 | nspr | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nspr-debuginfo | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nspr-devel | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nss | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-debuginfo | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-devel | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-pkcs11-devel | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-sysinit | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-tools | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-util | 3.19.1-4.47.amzn1 |
| amazon linux 1 | nss-util-debuginfo | 3.19.1-4.47.amzn1 |
| amazon linux 1 | nss-util-devel | 3.19.1-4.47.amzn1 |
| Oracle Linux 5 | nspr | 4.10.8-2.el5_11 |
| Oracle Linux 5 | nspr-devel | 4.10.8-2.el5_11 |
| Oracle Linux 5 | nss | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-devel | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-pkcs11-devel | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-tools | 3.19.1-2.el5_11 |
| Oracle Linux 6 | nspr | 4.10.8-2.el6_7 |
| Oracle Linux 6 | nspr-devel | 4.10.8-2.el6_7 |
| Oracle Linux 6 | nss | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-devel | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-pkcs11-devel | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-sysinit | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-tools | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-util | 3.19.1-2.el6_7 |
| Oracle Linux 6 | nss-util-devel | 3.19.1-2.el6_7 |
| Oracle Linux 7 | nspr | 4.10.8-2.el7_1 |
| Oracle Linux 7 | nspr-devel | 4.10.8-2.el7_1 |
| Oracle Linux 7 | nss | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-devel | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-pkcs11-devel | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-sysinit | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-tools | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-util | 3.19.1-4.el7_1 |
| Oracle Linux 7 | nss-util-devel | 3.19.1-4.el7_1 |
| debian 11 | nss | 2:3.20.1-1 |
| debian 12 | nss | 2:3.20.1-1 |
| debian 13 | nss | 2:3.20.1-1 |
| debian 14 | nss | 2:3.20.1-1 |
| debian 7 | icedove | 38.4.0-1~deb7u1 |
| debian 7 | iceweasel | 38.4.0esr-1~deb7u1 |
| debian 7 | nss | 2:3.14.5-1+deb7u6 |
| debian 8 | icedove | 38.4.0-1~deb8u1 |
| debian 8 | iceweasel | 38.4.0esr-1~deb8u1 |
| debian 8 | nss | 2:3.26-1+debu8u1 |
| echo | nss | 2:3.20.1-1 |
| root.io debian 11 | rootio-nss | 2:3.20.1-1 |
| root.io debian 12 | rootio-nss | 2:3.20.1-1 |
| root.io debian 13 | rootio-nss | 2:3.20.1-1 |
| ubuntu 12.04 | firefox | 42.0+build2-0ubuntu0.12.04.1 |
| ubuntu 12.04 | nss | 3.19.2.1-0ubuntu0.12.04.1 |
| ubuntu 12.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.12.04.1 |
| ubuntu 14.04 | firefox | 42.0+build2-0ubuntu0.14.04.1 |
| ubuntu 14.04 | nss | 2:3.19.2.1-0ubuntu0.14.04.1 |
| ubuntu 14.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.14.04.1 |
| ubuntu 14.04-ESM | nss | 2:3.19.2.1-0ubuntu0.14.04.1 |
| ubuntu 15.04 | firefox | 42.0+build2-0ubuntu0.15.04.1 |
| ubuntu 15.04 | nss | 2:3.19.2.1-0ubuntu0.15.04.1 |
| ubuntu 15.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.15.04.1 |
| ubuntu 15.10 | firefox | 42.0+build2-0ubuntu0.15.10.1 |
| ubuntu 15.10 | nss | 2:3.19.2.1-0ubuntu0.15.10.1 |
| ubuntu 15.10 | thunderbird | 1:38.4.0+build3-0ubuntu0.15.10.1 |
Références
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
Les 45 références
- http://rhn.redhat.com/errata/RHSA-2015-1980.html
- http://rhn.redhat.com/errata/RHSA-2015-1981.html
- http://www.debian.org/security/2015/dsa-3393
- http://www.debian.org/security/2015/dsa-3410
- http://www.debian.org/security/2016/dsa-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/77416
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1034069
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753
- http://www.ubuntu.com/usn/USN-2785-1
- http://www.ubuntu.com/usn/USN-2791-1
- http://www.ubuntu.com/usn/USN-2819-1
- https://access.redhat.com/articles/2043623
- https://access.redhat.com/security/cve/CVE-2015-7182
- https://bto.bluecoat.com/security-advisory/sa119
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202868
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- https://linux.oracle.com/cve/CVE-2015-7182.html
- https://linux.oracle.com/errata/ELSA-2015-1981.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-7182
- https://security.gentoo.org/glsa/201512-10
- https://security.gentoo.org/glsa/201605-06
- https://ubuntu.com/security/notices/USN-2785-1
- https://ubuntu.com/security/notices/USN-2791-1
- https://ubuntu.com/security/notices/USN-2819-1
- https://www.cve.org/CVERecord?id=CVE-2015-7182
- https://www.mozilla.org/en-US/security/advisories/mfsa2015-133/
- https://www.mozilla.org/security/announce/2015/mfsa2015-133.html