CVE-2016-1978

published 2016-03-13

CVE-2016-1978: Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla…

high 7.3 CVSS 3.0

AV N AC L PR N UI N S U C L I L A L

Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	nss	< nss 2:3.21-1 (bookworm)	nss 2:3.21-1 (bookworm)
mozilla	firefox	<= 43.0.4	—
mozilla	network_security_services	<= 3.20.1	—
mozilla	nss	>= 0 < 2:3.21-1	2:3.21-1
mozilla	nss	>= 0 < 2:3.21-1	2:3.21-1
mozilla	nss	>= 0 < 2:3.21-1	2:3.21-1
mozilla	nss	>= 0 < 2:3.21-1	2:3.21-1
mozilla	thunderbird	>= 0 < 1:38.8.0+build1-0ubuntu0.14.04.1	1:38.8.0+build1-0ubuntu0.14.04.1
mozilla	thunderbird	>= 0 < 1:38.8.0+build1-0ubuntu0.16.04.1	1:38.8.0+build1-0ubuntu0.16.04.1

CVSS provenance

nvd v3.0 7.3 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

osv 7.3 HIGH