CVE-2016-1979

Published on: 03/13/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:05 PM UTC

CVE-2016-1979

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Certain versions of Firefox from Mozilla contain the following vulnerability:

Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.

CVE-2016-1979 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 8.8 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
NETWORK	LOW	NONE	REQUIRED
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	HIGH	HIGH	HIGH

CVSS2 Score: 6.8 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
NETWORK	MEDIUM	NONE
Confidentiality Impact	Integrity Impact	Availability Impact
PARTIAL	PARTIAL	PARTIAL

CVE References

Description	Tags ^ⓘ	Link
Broadcom Support Portal	bto.bluecoat.com text/html	CONFIRM bto.bluecoat.com/security-advisory/sa124
[security-announce] SUSE-SU-2016:0909-1: important: Security update for	lists.opensuse.org text/html	SUSE SUSE-SU-2016:0909
Use-after-free during processing of DER encoded keys in NSS — Mozilla	Vendor Advisory www.mozilla.org text/html	CONFIRM www.mozilla.org/security/announce/2016/mfsa2016-36.html
1185033 – (CVE-2016-1979) ASan: use-after-poison in PK11_ImportDERPrivateKeyInfoAndReturnKey()	bugzilla.mozilla.org text/html	CONFIRM bugzilla.mozilla.org/show_bug.cgi?id=1185033
Mozilla Products: Multiple vulnerabilities (GLSA 201605-06) — Gentoo security	security.gentoo.org text/html	GENTOO GLSA-201605-06
NSS 3.21.1 release notes - Mozilla \| MDN	developer.mozilla.org text/html	MISC developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21.1_release_notes
Red Hat Customer Portal	web.archive.org text/html Inactive LinkNot Archived	REDHAT RHSA-2016:0684
[security-announce] openSUSE-SU-2016:0733-1: important: Security update	lists.opensuse.org text/html	SUSE openSUSE-SU-2016:0733
USN-2973-1: Thunderbird vulnerabilities \| Ubuntu	www.ubuntu.com text/html	UBUNTU USN-2973-1
[security-announce] SUSE-SU-2016:0820-1: important: Security update for	lists.opensuse.org text/html	SUSE SUSE-SU-2016:0820
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Spoof the Address Bar, Overwrite Files, and Deny Service - SecurityTracker	www.securitytracker.com text/html	SECTRACK 1035215
Debian -- Security Information -- DSA-3576-1 icedove	www.debian.org Depreciated Link text/html	DEBIAN DSA-3576
Debian -- Security Information -- DSA-3688-1 nss	www.debian.org Depreciated Link text/html	DEBIAN DSA-3688
Oracle Linux Bulletin - April 2016	www.oracle.com text/html	CONFIRM www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
Oracle VM Server for x86 Bulletin - July 2016	web.archive.org text/html Inactive LinkNot Archived	CONFIRM www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Red Hat Customer Portal	web.archive.org text/html Inactive LinkNot Archived	REDHAT RHSA-2016:0591
[security-announce] openSUSE-SU-2016:0731-1: important: Security update	lists.opensuse.org text/html	SUSE openSUSE-SU-2016:0731
Red Hat Customer Portal	web.archive.org text/html Inactive LinkNot Archived	REDHAT RHSA-2016:0685
[security-announce] SUSE-SU-2016:0777-1: important: Security update for	lists.opensuse.org text/html	SUSE SUSE-SU-2016:0777
Mozilla Network Security Services Use After Free CVE-2016-1979 Denial of Service Vulnerability	cve.report (archive) text/html	BID 84221
Oracle Critical Patch Update - July 2017	www.oracle.com text/html	CONFIRM www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Oracle Critical Patch Update - October 2017	www.oracle.com text/html	CONFIRM www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
[security-announce] SUSE-SU-2016:0727-1: important: Security update for	lists.opensuse.org text/html	SUSE SUSE-SU-2016:0727

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Mozilla	Firefox	All	All	All	All
Application	Mozilla	Network Security Services	All	All	All	All

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*:
cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE