Use-after-free vulnerability in nss
Summary
DSA-3071-1: nss - security update. Affects nss versions < 2:3.14.5-1+deb7u3. Fixed in 2:3.14.5-1+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nss is a set of libraries designed to support cross-platform development of security-enabled client and server applications. It provides a range of cryptographic services, including SSL/TLS support. The vulnerability affects the nss package in Debian 7 (wheezy), Debian 8 (jessie), and Debian unstable (sid).
Vulnerability Detail
The vulnerability in nss is a use-after-free flaw that allows remote attackers to execute arbitrary code. It occurs due to the improper removal of an NSSCertificate structure from a trust domain. By triggering this vulnerability, an attacker can manipulate memory in a way that can lead to the execution of malicious code.
How To Fix
Minimum fixed version
2:3.14.5-1+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nssTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The use-after-free vulnerability in nss can be exploited by remote attackers to execute arbitrary code. It is recommended to upgrade the nss package to the fixed versions mentioned above. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nss →
FAQ
nss is a set of libraries that provide cryptographic services for security-enabled client and server applications.
A use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed, leading to potential memory corruption and the possibility of executing arbitrary code.
This vulnerability can be exploited by remote attackers who can trigger the improper removal of an NSSCertificate structure from a trust domain, allowing them to manipulate memory and execute arbitrary code.
The vulnerability affects nss in Debian 7 (wheezy), Debian 8 (jessie), and Debian unstable (sid).
To fix this vulnerability, upgrade the nss package to the fixed versions: 2:3.14.5-1+deb7u3 for Debian 7 (wheezy), and 2:3.16.3-1 for Debian 8 (jessie) and Debian unstable (sid).
Related vulnerabilities
Recent vulnerabilities recorded for nss.
