kritik
CVE-2015-7182
nss: ASN.1 decoder heap overflow when decoding constructed OCTET STRING that mixes indefinite and definite length encodings (MFSA 2015-133)
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Red Hat, Amazon, Oracle. Daha düşük diyenler: Ubuntu (orta).
Açıklama
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | jss, jss-debuginfo, jss-javadoc ve 12 tane daha | 4.2.6-35.17.amzn1 ve 3 tane daha |
| Oracle Linux 5 | nspr, nspr-devel, nss ve 3 tane daha | 4.10.8-2.el5_11 ve 1 tane daha |
| Oracle Linux 6 | nspr, nspr-devel, nss ve 6 tane daha | 4.10.8-2.el6_7 ve 2 tane daha |
| Oracle Linux 7 | nspr, nspr-devel, nss ve 6 tane daha | 4.10.8-2.el7_1 ve 2 tane daha |
| debian 11 | nss | 2:3.20.1-1 |
| debian 12 | nss | 2:3.20.1-1 |
| debian 13 | nss | 2:3.20.1-1 |
| debian 14 | nss | 2:3.20.1-1 |
| debian 7 | icedove, iceweasel, nss | 38.4.0-1~deb7u1 ve 2 tane daha |
| debian 8 | icedove, iceweasel, nss | 38.4.0-1~deb8u1 ve 2 tane daha |
| echo | nss | 2:3.20.1-1 |
| root.io debian 11 | rootio-nss | 2:3.20.1-1 |
19 kaynaktaki 66 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | jss | 4.2.6-35.17.amzn1 |
| amazon linux 1 | jss-debuginfo | 4.2.6-35.17.amzn1 |
| amazon linux 1 | jss-javadoc | 4.2.6-35.17.amzn1 |
| amazon linux 1 | nspr | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nspr-debuginfo | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nspr-devel | 4.10.8-2.35.amzn1 |
| amazon linux 1 | nss | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-debuginfo | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-devel | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-pkcs11-devel | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-sysinit | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-tools | 3.19.1-7.74.amzn1 |
| amazon linux 1 | nss-util | 3.19.1-4.47.amzn1 |
| amazon linux 1 | nss-util-debuginfo | 3.19.1-4.47.amzn1 |
| amazon linux 1 | nss-util-devel | 3.19.1-4.47.amzn1 |
| Oracle Linux 5 | nspr | 4.10.8-2.el5_11 |
| Oracle Linux 5 | nspr-devel | 4.10.8-2.el5_11 |
| Oracle Linux 5 | nss | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-devel | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-pkcs11-devel | 3.19.1-2.el5_11 |
| Oracle Linux 5 | nss-tools | 3.19.1-2.el5_11 |
| Oracle Linux 6 | nspr | 4.10.8-2.el6_7 |
| Oracle Linux 6 | nspr-devel | 4.10.8-2.el6_7 |
| Oracle Linux 6 | nss | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-devel | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-pkcs11-devel | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-sysinit | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-tools | 3.19.1-5.0.1.el6_7 |
| Oracle Linux 6 | nss-util | 3.19.1-2.el6_7 |
| Oracle Linux 6 | nss-util-devel | 3.19.1-2.el6_7 |
| Oracle Linux 7 | nspr | 4.10.8-2.el7_1 |
| Oracle Linux 7 | nspr-devel | 4.10.8-2.el7_1 |
| Oracle Linux 7 | nss | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-devel | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-pkcs11-devel | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-sysinit | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-tools | 3.19.1-7.0.1.el7_1.2 |
| Oracle Linux 7 | nss-util | 3.19.1-4.el7_1 |
| Oracle Linux 7 | nss-util-devel | 3.19.1-4.el7_1 |
| debian 11 | nss | 2:3.20.1-1 |
| debian 12 | nss | 2:3.20.1-1 |
| debian 13 | nss | 2:3.20.1-1 |
| debian 14 | nss | 2:3.20.1-1 |
| debian 7 | icedove | 38.4.0-1~deb7u1 |
| debian 7 | iceweasel | 38.4.0esr-1~deb7u1 |
| debian 7 | nss | 2:3.14.5-1+deb7u6 |
| debian 8 | icedove | 38.4.0-1~deb8u1 |
| debian 8 | iceweasel | 38.4.0esr-1~deb8u1 |
| debian 8 | nss | 2:3.26-1+debu8u1 |
| echo | nss | 2:3.20.1-1 |
| root.io debian 11 | rootio-nss | 2:3.20.1-1 |
| root.io debian 12 | rootio-nss | 2:3.20.1-1 |
| root.io debian 13 | rootio-nss | 2:3.20.1-1 |
| ubuntu 12.04 | firefox | 42.0+build2-0ubuntu0.12.04.1 |
| ubuntu 12.04 | nss | 3.19.2.1-0ubuntu0.12.04.1 |
| ubuntu 12.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.12.04.1 |
| ubuntu 14.04 | firefox | 42.0+build2-0ubuntu0.14.04.1 |
| ubuntu 14.04 | nss | 2:3.19.2.1-0ubuntu0.14.04.1 |
| ubuntu 14.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.14.04.1 |
| ubuntu 14.04-ESM | nss | 2:3.19.2.1-0ubuntu0.14.04.1 |
| ubuntu 15.04 | firefox | 42.0+build2-0ubuntu0.15.04.1 |
| ubuntu 15.04 | nss | 2:3.19.2.1-0ubuntu0.15.04.1 |
| ubuntu 15.04 | thunderbird | 1:38.4.0+build3-0ubuntu0.15.04.1 |
| ubuntu 15.10 | firefox | 42.0+build2-0ubuntu0.15.10.1 |
| ubuntu 15.10 | nss | 2:3.19.2.1-0ubuntu0.15.10.1 |
| ubuntu 15.10 | thunderbird | 1:38.4.0+build3-0ubuntu0.15.10.1 |
Referanslar
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html
45 referansın hepsi
- http://rhn.redhat.com/errata/RHSA-2015-1980.html
- http://rhn.redhat.com/errata/RHSA-2015-1981.html
- http://www.debian.org/security/2015/dsa-3393
- http://www.debian.org/security/2015/dsa-3410
- http://www.debian.org/security/2016/dsa-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/77416
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1034069
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753
- http://www.ubuntu.com/usn/USN-2785-1
- http://www.ubuntu.com/usn/USN-2791-1
- http://www.ubuntu.com/usn/USN-2819-1
- https://access.redhat.com/articles/2043623
- https://access.redhat.com/security/cve/CVE-2015-7182
- https://bto.bluecoat.com/security-advisory/sa119
- https://bugzilla.mozilla.org/show_bug.cgi?id=1202868
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
- https://linux.oracle.com/cve/CVE-2015-7182.html
- https://linux.oracle.com/errata/ELSA-2015-1981.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-7182
- https://security.gentoo.org/glsa/201512-10
- https://security.gentoo.org/glsa/201605-06
- https://ubuntu.com/security/notices/USN-2785-1
- https://ubuntu.com/security/notices/USN-2791-1
- https://ubuntu.com/security/notices/USN-2819-1
- https://www.cve.org/CVERecord?id=CVE-2015-7182
- https://www.mozilla.org/en-US/security/advisories/mfsa2015-133/
- https://www.mozilla.org/security/announce/2015/mfsa2015-133.html