MiracleLinux 9 : firefox-91.13.0-1.el9.ML.1 (AXSA:2022-4048:34)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4048:34 advisory. Mozilla: Address bar spoofing via XSLT error handling CVE-2022-38472 Mozilla: Cross-origin XSLT Documents would have inherited the parent's...

MiracleLinux 8 : bind-9.11.20-5.el8 (AXSA:2021-1277:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1277:01 advisory. bind: asterisk character in an empty non-terminal can cause an assertion failure in rbtdb.c CVE-2020-8619 bind: truncated TSIG response can lead to ...

NSS encryption Mozilla Firefox ESR Information Disclosure

The vulnerability of the CKMCHACHA20 font set in Mozilla Firefox and Firefox ESR browsers is related to the possibility of buffer overflow in dynamic memory. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a call to PK11Encrypt...

Mozilla Firefox and Firefox ESR Information Disclosure Vulnerability (CNVD-2024-37122)

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. Mozilla Firefox and Firefox ESR suffer from an information disclosure vulnerability that stems from PK11Encrypt disclosing sensitive information under certain circumstances. An...

UBUNTU-CVE-2024-7531

Calling PK11Encrypt in NSS using CKMCHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcom...

PT-2024-5756

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 129 Firefox ESR versions prior to 115.14 Firefox ESR versions prior to 128.1 Description The issue is related to a buffer overflow in the CKM CHACHA20 font set of Mozilla Firefox and Firefox ESR browsers. This can be...

Mozilla Firefox Thunderbird DoS

The vulnerability of the PK11ChangePW function in the Mozilla Firefox browser and Thunderbird email client is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause service interruptions...

UBUNTU-CVE-2022-38476

A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password. This vulnerability affects Firefox ESR 102.2 and Thunderbird 102.2...

Mozilla: Data race and potential use-after-free in PK11_ChangePW

The Mozilla Foundation Security Advisory describes this flaw as: A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password...

Mozilla: Data race and potential use-after-free in PK11_ChangePW

The Mozilla Foundation Security Advisory describes this flaw as: A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password...

Mozilla: Data race and potential use-after-free in PK11_ChangePW

The Mozilla Foundation Security Advisory describes this flaw as: A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password...

Mozilla Firefox ESR resource management error vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox ESR prior to version 102.2, which stems from a possible data contention issue in the PK11ChangePW function that can lead to reuse after release, and i...

PT-2022-4434

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 102.2 Thunderbird versions prior to 102.2 Description A data race could occur in the PK11 ChangePW function, potentially leading to a use-after-free issue. This affects the protection of data when a user changes...

nss: Use-after-free in sftk_FreeSession due to improper refcounting

A use-after-free flaw was found in Mozilla Network Security Services NSS related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS...

bind: remotely triggerable assertion failure in pk11.c

A flaw was found in bind. An assertion failure can occur when a specially crafted query for a zone signed with an RSA key. BIND must be compiled with "--enable-native-pkcs11" for the system to be affected. The highest threat from this vulnerability is to system availability...

CVE-2019-11756

A use-after-free flaw was found in Mozilla Network Security Services NSS related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS...

PT-2016-6342

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services affected versions not specified Description A Null pointer dereference issue exists due to a missing NULL check in PK11 SignWithSymKey / ssl3 ComputeRecordMACConstantTime, which could let a remote malicious us...

PT-2016-1438

Name of the Vulnerable Software and Affected Versions Network Security Services NSS versions prior to 3.21.1 Mozilla Firefox versions prior to 45.0 Description The issue is related to a use-after-free vulnerability in the PK11 ImportDERPrivateKeyInfoAndReturnKey function. This vulnerability can b...