The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html | |
| http://www.mozilla.org/security/announce/2012/mfsa2012-39.html | vendor advisory |
| http://secunia.com/advisories/49976 | third party advisory |
| http://www.ubuntu.com/usn/USN-1540-2 | vendor advisory |
| http://www.mandriva.com/security/advisories?name=MDVSA-2012:088 | vendor advisory |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16701 | signature vdb entry |
| https://bugzilla.mozilla.org/show_bug.cgi?id=715073 | |
| http://www.securityfocus.com/bid/53798 | vdb entry |
| http://www.debian.org/security/2012/dsa-2490 | vendor advisory |
| http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html | vendor advisory |
| http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00015.html | vendor advisory |
| http://secunia.com/advisories/50316 | third party advisory |
| http://www.ubuntu.com/usn/USN-1540-1 | vendor advisory |