NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS S/MIME PKCS \#7 or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS X.509 OCSP or CRL functionality may be impacted depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However email clients and PDF viewers that use NSS for signature verification such as Thunderbird LibreOffice Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

🗓️ 17 Dec 2021 08:00:00Reported by MicrosoftType

NSS below 3.73 and 3.68.1 ESR causes a heap overflow with DER DSA and RSA PSS signatures, potentially impacting S M I ME, PKCS seven and twelve, TLS X509 validation, and some mail/pdf viewers; not Firefox.

Reporter	Title	Published	Views	Family All 347
FreeBSD	NSS -- Memory corruption	1 Dec 202100:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities.	22 Nov 202206:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is using components with known vulnerabilities	31 Mar 202214:40	–	ibm
IBM Security Bulletins	Security Bulletin: Heap-Based Buffer Overflow in Mozilla Network Security Services (NSS) may affect IBM Spectrum Protect Plus (CVE-2021-43527)	17 May 202223:25	–	ibm
ATTACKERKB	CVE-2021-43527	8 Dec 202122:15	–	attackerkb
Tenable Nessus	Amazon Linux 2022 : nss (ALAS2022-2021-002)	11 Dec 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : nss (ALAS2022-2022-223)	9 Dec 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2023-031)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nss, nss-util, nss-softokn, nspr (ALAS-2021-1722)	1 Dec 202100:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nss (ALAS-2023-1952)	22 Feb 202300:00	–	nessus