Mozilla fixes critical bug in its Network Security Services (NSS) set of cryptography libraries

guest · Dec 6, 2021

December 1, 2021

Mozilla has addressed a critical memory corruption vulnerability affecting its cross-platform Network Security Services (NSS) set of cryptography libraries.

NSS can be used to develop security-enabled client and server apps with support for SSL v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and various other security standards.
Click to expand...

The security flaw was found by Google vulnerability researcher Tavis Ormandy in NSS versions before 3.73 or 3.68.1 ESR—who also dubbed it BigSig—and is now tracked as CVE-2021-43527.
All versions released since October 2012 vulnerable

"Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted," Mozilla said in a security advisory issued today.
"We believe all versions of NSS since 3.14 (released October 2012) are vulnerable," Ormandy added on the Project Zero issue tracker.
Click to expand...

Luckily, according to Mozilla, this vulnerability doesn't impact the Mozilla Firefox web browser. However, all PDF viewers and email clients which use NSS for signature verification are believed to be impacted.

NSS is used by Mozilla, Red Hat, Google, SUSE, and others in a wide variety of products, including: [...]
Click to expand...

Log in or Sign up

Mozilla fixes critical bug in its Network Security Services (NSS) set of cryptography libraries

guest Guest

Log in or Sign up

Mozilla fixes critical bug in its Network Security Services (NSS) set of cryptography libraries

guest Guest

Useful Searches