NS
Product
Network Security Services
50
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 12Medium 8Low 1
Watch
Add Network Security Services to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17006 | 9.8 | Oct 22 | In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks Affected: before 3.46 |
| CVE-2017-5461 | 9.8 | May 11 | Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a… Affected: before 3.21.4; after 3.22 before 3.28.4; 3.29 before 3.29.5; 3.30 before 3.30.1 |
| CVE-2015-7182 | 9.8 | Nov 5 | Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR… Affected: through 3.19.2.0; 3.20.0 |
| CVE-2016-2834 | 8.8 | Jun 13 | Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and… Affected: through 3.22 |
| CVE-2016-1979 | 8.8 | Mar 13 | Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before… Affected: through 3.21 |
| CVE-2016-1950 | 8.8 | Mar 13 | Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR… Affected: 3.19.2; 3.20; 3.20.1; 3.21 |
| CVE-2017-11698 | 7.8 | Dec 27 | Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified… Affected: All versions, or not specified |
| CVE-2017-11697 | 7.8 | Dec 27 | The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and… Affected: All versions, or not specified |
| CVE-2017-11696 | 7.8 | Dec 27 | Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified… Affected: All versions, or not specified |
| CVE-2017-11695 | 7.8 | Dec 27 | Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified… Affected: All versions, or not specified |
| CVE-2022-3479 | 7.5 | Oct 14 | A vulnerability found in nss Affected: 3.77 before 3.87 |
| CVE-2019-17007 | 7.5 | Oct 22 | In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service Affected: before 3.44 |
| CVE-2020-25648 | 7.5 | Oct 20 | A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3 Affected: before 3.58 |
| CVE-2017-7502 | 7.5 | May 30 | Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker Affected: 3.24.0; 3.25.0; 3.25.1; 3.26.0; 3.26.2; 3.27.0; +12 more |
| CVE-2016-1978 | 7.3 | Mar 13 | Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0,… Affected: through 3.20.1 |
| CVE-2018-18508 | 6.5 | Oct 22 | In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service Affected: before 3.36.7; 3.41 before 3.41.1 |
| CVE-2018-12404 | 5.9 | May 2 | A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content Affected: before 3.41 |
| CVE-2018-12384 | 5.9 | Apr 29 | When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead Affected: before 3.39 |
| CVE-2016-8635 | 5.9 | Aug 1 | It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack Affected: 3.21 through 3.21.4 |
| CVE-2016-9574 | 5.9 | Jul 19 | nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA Affected: before 3.30 |
| CVE-2015-7575 | 5.9 | Jan 9 | Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key… Affected: through 3.20.1 |
| CVE-2009-2408 | 5.9 | Jul 30 | Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a… Affected: before 3.12.3 |
| CVE-2017-5462 | 5.3 | Jun 11 | A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over Affected: before 3.28.4 |
| CVE-2015-4000 | 3.7 | May 21 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows… Affected: 3.19 |
| CVE-2015-7183 | – | Nov 5 | Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1,… Affected: through 3.19.2.0; 3.20.0 |
| CVE-2015-7181 | – | Nov 5 | The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before… Affected: through 3.19.2.0; 3.20.0 |
| CVE-2015-2730 | – | Jul 6 | Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not… Affected: through 3.19 |
| CVE-2015-2721 | – | Jul 6 | Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other… Affected: 3.19 |
| CVE-2014-1569 | – | Dec 15 | The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER… Affected: through 3.16.2.3; 3.16.2.0; 3.16.2.1; 3.16.2.2; 3.17.0; 3.17.1; +1 more |
| CVE-2014-1568 | – | Sep 25 | Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before… Affected: through 3.16.2.0; 3.2; 3.2.1; 3.3; 3.3.1; 3.3.2; +34 more |
| CVE-2014-1544 | – | Jul 23 | Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x… Affected: 3.2; 3.2.1; 3.3; 3.3.1; 3.3.2; 3.4; +34 more |
| CVE-2014-1492 | – | Mar 25 | The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard… Affected: through 3.15.5; 3.2; 3.2.1; 3.3; 3.3.1; 3.3.2; +34 more |
| CVE-2014-1491 | – | Feb 6 | Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and… Affected: before 3.15.4 |
| CVE-2014-1490 | – | Feb 6 | Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3,… Affected: before 3.15.4 |
| CVE-2013-1740 | – | Jan 18 | The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows… Affected: through 3.15.3; 3.2; 3.2.1; 3.3; 3.3.1; 3.3.2; +34 more |
| CVE-2013-5606 | – | Nov 18 | The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible… Affected: 3.15; 3.15.1; 3.15.2 |
| CVE-2013-5605 | – | Nov 18 | Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact… Affected: 3.14; 3.14.1; 3.14.2; 3.14.3; 3.14.4; 3.15; +2 more |
| CVE-2013-1741 | – | Nov 18 | Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a… Affected: 3.15; 3.15.1; 3.15.2 |
| CVE-2013-1739 | – | Oct 22 | Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial… Affected: through 3.15.1; 3.12; 3.12.1; 3.12.2; 3.12.3; 3.12.3.1; +14 more |
| CVE-2013-0791 | – | Apr 3 | The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5,… Affected: before 3.15 |
| CVE-2013-1620 | – | Feb 8 | The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the… Affected: before 3.14.3 |
| CVE-2011-5094 | – | Jun 16 | Mozilla Network Security Services (NSS) 3.x, with certain settings of the SSL_ENABLE_RENEGOTIATION option, does not properly restrict client-initiated renegotiation within the SSL… Affected: 3.2; 3.2.1; 3.3; 3.3.1; 3.3.2; 3.4; +17 more |
| CVE-2012-0441 | – | Jun 5 | The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5,… Affected: through 3.12.3; 3.2; 3.2.1; 3.3; 3.3.1; 3.3.2; +21 more |
| CVE-2009-2404 | – | Aug 3 | Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin,… Affected: 3.12.3 |
| CVE-2009-2409 | – | Jul 30 | The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with… Affected: before 3.12.3 |
| CVE-2007-0008 | – | Feb 26 | Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8,… Affected: 3.11.2; 3.11.3; 3.11.4 |
| CVE-2007-0009 | – | Feb 26 | Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird… Affected: before 3.11.5 |
| CVE-2006-5462 | – | Nov 8 | Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA… Affected: 3.11.3 |
| CVE-2006-4340 | – | Sep 15 | Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA… Affected: through 3.11.2 |
| CVE-2004-0826 | – | Dec 31 | Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2… Affected: 3.2; 3.2.1; 3.3; 3.3.1; 3.3.2; 3.4; +13 more |
Showing 50