CVEvulnerability

CVE-2021-43527

9.8 CRITICAL Published 2021-12-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-12-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-787

Description

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

Affected configurations

• mozilla nss (< 3.73) • mozilla nss esr (< 3.68.1) • netapp cloud backup • netapp e-series santricity os controller (>= 11.0 <= 11.70.1) • oracle communications cloud native core binding support function 1.11.0 • oracle communications cloud native core network repository function 1.15.0 • oracle communications cloud native core network repository function 1.15.1 • oracle communications cloud native core network slice selection function 1.8.0 • oracle communications policy management 12.6.0.0.0 • starwindsoftware starwind san \& nas v8r13 • starwindsoftware starwind virtual san v8r13

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References