CoreCVE
Back

CRITICAL

nss: Write beyond bounds caused by bugs in Base64 de/encoding in nssb64d.c and nssb64e.c (MFSA 2017-10)

Published May 11, 2017

Description

Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.

Affected products

Remediation

Red Hat statement

The security flaw exists in NSS library Base64 encoder/decoder code. Any application which uses NSS library to parse base64 encoded data could possibly be affected by the flaw. For example: 1. Servers compiled against NSS which parse untrusted certificates or any other base64 encoded data from its users. 2. Utilities like curl etc which use NSS to parse user provided base64 encoded certificates. 3. Applications like Firefox which use NSS to parse client-certificates before passing them to the web server.

Metrics

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (25)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mozilla
Published May 11, 2017
Updated Aug 5, 2024
Reserved Jan 13, 2017
Link CVE-2017-5461
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-5461
Red Hat
Severity Critical
Public date Apr 19, 2017
Links CVE-2017-5461 - Bugzilla