Vulnerability Description
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Network Security Services | 3.19.2 |
| Mozilla | Firefox | <= 44.0.2 |
| Oracle | Linux | 5.0 |
| Oracle | Vm Server | 3.2 |
| Apple | Iphone Os | <= 9.2.1 |
| Apple | Mac Os X | <= 10.11.3 |
| Apple | Tvos | <= 9.1 |
| Apple | Watchos | <= 2.1 |
| Oracle | Glassfish Server | 2.1.1 |
| Oracle | Iplanet Web Proxy Server | 4.0 |
| Oracle | Iplanet Web Server | 7.0 |
| Opensuse | Opensuse | 13.1 |
Related Weaknesses (CWE)
References
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.htmlMailing List
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.htmlMailing List
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.htmlMailing List
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlMailing List
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00050.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00068.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00093.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0495.html
- http://www.debian.org/security/2016/dsa-3510
- http://www.debian.org/security/2016/dsa-3520
- http://www.debian.org/security/2016/dsa-3688
FAQ
What is CVE-2016-1950?
CVE-2016-1950 is a vulnerability with a CVSS score of 8.8 (HIGH). Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allo...
How severe is CVE-2016-1950?
CVE-2016-1950 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-1950?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Network Security Services, Mozilla Firefox, Oracle Linux, Oracle Vm Server, Apple Iphone Os.