CVE-2013-5606: The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an…

PriorityP431medium5.8CVSS 2.0

AVNACMAuNCPIPAN

EPSS

2.40%

82.2th percentile

The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	nss	< nss 2:3.15.3-1 (bookworm)	nss 2:3.15.3-1 (bookworm)
mozilla	network_security_services	—	—
mozilla	network_security_services	—	—
mozilla	network_security_services	—	—
mozilla	nss	>= 0 < 2:3.15.3-1	2:3.15.3-1
mozilla	nss	>= 0 < 2:3.15.3-1	2:3.15.3-1
mozilla	nss	>= 0 < 2:3.15.3-1	2:3.15.3-1
mozilla	nss	>= 0 < 2:3.15.3-1	2:3.15.3-1

CVSS provenance

nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

osv5.8MEDIUM

vendor_debian5.8MEDIUM

vendor_redhat5.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.