CVE-2019-17006: Buffer Overflow
Mozilla Network Security Services (NSS), as used in Mozilla Firefox is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when using certain cryptographic primitives. By sending an overly long argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause a denial of service.
Other sources
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.
A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-17006?
CVE-2019-17006 refers to a vulnerability in Mozilla Network Security Services (NSS) that allows a remote attacker to execute arbitrary code through a heap-based buffer overflow.
What is the severity of CVE-2019-17006?
CVE-2019-17006 has a severity value of 9.8, which is considered critical.
How does CVE-2019-17006 affect Mozilla Firefox?
CVE-2019-17006 affects Mozilla Firefox through the vulnerable Network Security Services (NSS) component.
How can CVE-2019-17006 be fixed?
To fix CVE-2019-17006, update to Network Security Services (NSS) version 3.46 or higher.
Where can I find more information about CVE-2019-17006?
More information about CVE-2019-17006 can be found in the Mozilla NSS release notes, Red Hat Bugzilla, and the Red Hat security advisory.