Vulnerability Description
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Traffic Director | 11.1.1.7.0 |
| Oracle | Opensso | 3.0-0.7 |
| Oracle | Iplanet Web Proxy Server | 4.0 |
| Mozilla | Firefox | 38.0 |
| Oracle | Glassfish Server | 2.1.1 |
| Mozilla | Network Security Services | <= 3.19.2.0 |
| Oracle | Iplanet Web Server | 7.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html
- http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-
- http://rhn.redhat.com/errata/RHSA-2015-1980.html
- http://rhn.redhat.com/errata/RHSA-2015-1981.html
- http://www.debian.org/security/2015/dsa-3393
- http://www.debian.org/security/2015/dsa-3410
- http://www.debian.org/security/2016/dsa-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-133.htmlVendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlPatch
FAQ
What is CVE-2015-7182?
CVE-2015-7182 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and...
How severe is CVE-2015-7182?
CVE-2015-7182 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2015-7182?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Traffic Director, Oracle Opensso, Oracle Iplanet Web Proxy Server, Mozilla Firefox, Oracle Glassfish Server.