CVE-2015-7575

CVE-2015-7575 affects NSS (used by Mozilla Firefox) where MD5 signatures in TLS 1.2 ServerKeyExchange are accepted, enabling potential MITM server impersonation. The published description notes NSS before 3.20.2 and Firefox before 43.0.2 / ESR 38.x before 38.5.2 are impacted. Debian/IBM/AIX advis...

CVE-2016-1950

CVE-2016-1950 is a real NSS vulnerability: a heap-based buffer overflow in the ASN.1 DER parser allows remote code execution via crafted data in X.509 certificates. Affected NSS releases include 3.19.2.3 and 3.20.x, and 3.21.x before 3.21.1; it affects Mozilla Firefox up to 45.0 and Firefox ESR 3...

CVE-2016-2834

CVE-2016-2834 concernsMozilla Network Security Services (NSS), as used in Mozilla Firefox, with NSS versions before 3.23. Exploitation can lead to remote code execution, memory corruption, or denial of service, per connected IBM advisories. Relevant IBM records show NSS in various IBM products (P...

CVE-2016-1978

Summary: CVE-2016-1978 is a use-after-free flaw in NSS related to ECDH/DHE TLS handshakes. The issue occurs in ssl3_HandleECDHServerKeyExchange and can allow a remote attacker to cause a denial of service or other impact during high memory consumption. It affects NSS before 3.21 as used in Mozill...

CVE-2016-1979

CVE-2016-1979 is a use-after-free vulnerability in NSS (PK11_ImportDERPrivateKeyInfoAndReturnKey) affecting NSS libraries used by Firefox prior to 45.0, with the issue triggered by crafted DER-encoded key data. Multiple connected advisories (Debian DSA/DLA entries, CentOS/CESA, and F5 advisory) c...