CVE-2019-11745

A heap-based buffer overflow was found in the NSCEncryptUpdate function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or decrypt operations, to execute arbitrary code with the permissions of the user running the application compiled with nss. While the attack complexi...

Amazon Linux 2 : nss (ALAS-2020-1384)

The version of nss installed on the remote host is prior to 3.44.0-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1384 advisory. A heap-based buffer overflow was found in the NSCEncryptUpdate function in Mozilla nss. A remote attacker could trigger this...

Amazon Linux 2 : nss-softokn (ALAS-2020-1379)

The version of nss-softokn installed on the remote host is prior to 3.44.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1379 advisory. Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized befor...