CVE-2016-1979

Published on: 03/13/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:05 PM UTC

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Certain versions of Firefox from Mozilla contain the following vulnerability:

Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.

  • CVE-2016-1979 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 8.8 - HIGH

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK LOW NONE REQUIRED
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED HIGH HIGH HIGH

CVSS2 Score: 6.8 - MEDIUM

Access
Vector
Access
Complexity
Authentication
NETWORK MEDIUM NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
PARTIAL PARTIAL PARTIAL

CVE References

Description Tags Link
Broadcom Support Portal bto.bluecoat.com
text/html
URL Logo CONFIRM bto.bluecoat.com/security-advisory/sa124
[security-announce] SUSE-SU-2016:0909-1: important: Security update for lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:0909
Use-after-free during processing of DER encoded keys in NSS — Mozilla Vendor Advisory
www.mozilla.org
text/html
URL Logo CONFIRM www.mozilla.org/security/announce/2016/mfsa2016-36.html
1185033 – (CVE-2016-1979) ASan: use-after-poison in PK11_ImportDERPrivateKeyInfoAndReturnKey() bugzilla.mozilla.org
text/html
URL Logo CONFIRM bugzilla.mozilla.org/show_bug.cgi?id=1185033
Mozilla Products: Multiple vulnerabilities (GLSA 201605-06) — Gentoo security security.gentoo.org
text/html
URL Logo GENTOO GLSA-201605-06
NSS 3.21.1 release notes - Mozilla | MDN developer.mozilla.org
text/html
URL Logo MISC developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21.1_release_notes
Red Hat Customer Portal web.archive.org
text/html
Inactive LinkNot Archived
URL Logo REDHAT RHSA-2016:0684
[security-announce] openSUSE-SU-2016:0733-1: important: Security update lists.opensuse.org
text/html
URL Logo SUSE openSUSE-SU-2016:0733
USN-2973-1: Thunderbird vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2973-1
[security-announce] SUSE-SU-2016:0820-1: important: Security update for lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:0820
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Spoof the Address Bar, Overwrite Files, and Deny Service - SecurityTracker www.securitytracker.com
text/html
URL Logo SECTRACK 1035215
Debian -- Security Information -- DSA-3576-1 icedove www.debian.org
Depreciated Link
text/html
URL Logo DEBIAN DSA-3576
Debian -- Security Information -- DSA-3688-1 nss www.debian.org
Depreciated Link
text/html
URL Logo DEBIAN DSA-3688
Oracle Linux Bulletin - April 2016 www.oracle.com
text/html
URL Logo CONFIRM www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
Oracle VM Server for x86 Bulletin - July 2016 web.archive.org
text/html
Inactive LinkNot Archived
URL Logo CONFIRM www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Red Hat Customer Portal web.archive.org
text/html
Inactive LinkNot Archived
URL Logo REDHAT RHSA-2016:0591
[security-announce] openSUSE-SU-2016:0731-1: important: Security update lists.opensuse.org
text/html
URL Logo SUSE openSUSE-SU-2016:0731
Red Hat Customer Portal web.archive.org
text/html
Inactive LinkNot Archived
URL Logo REDHAT RHSA-2016:0685
[security-announce] SUSE-SU-2016:0777-1: important: Security update for lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:0777
Mozilla Network Security Services Use After Free CVE-2016-1979 Denial of Service Vulnerability cve.report (archive)
text/html
URL Logo BID 84221
Oracle Critical Patch Update - July 2017 www.oracle.com
text/html
URL Logo CONFIRM www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Oracle Critical Patch Update - October 2017 www.oracle.com
text/html
URL Logo CONFIRM www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
[security-announce] SUSE-SU-2016:0727-1: important: Security update for lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:0727

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationMozillaFirefoxAllAllAllAll
ApplicationMozillaNetwork Security ServicesAllAllAllAll
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*: