Mozilla NSS
6 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-4421 | unspecified – < 3.61 | The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctn | MEDIUM 6.5 | 0.8 % | ||
| CVE-2021-43527 | unspecified – < 3.73 ; unspecified – < 3.68.1 | NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA- | CRITICAL 9.8 | 18 % | ||
| CVE-2019-17007 | unspecified – < 3.44 | In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service | HIGH 7.5 | 1.4 % | ||
| CVE-2019-17006 | unspecified – < 3.46 | In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application c | CRITICAL 9.8 | 3.6 % | ||
| CVE-2018-18508 | unspecified – < 3.41.1 ; unspecified – < 3.36.7 | In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resul | MEDIUM 6.5 | 2.0 % | ||
| CVE-2016-8635 | 3.21.x | It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker | MEDIUM 5.9 | 2.0 % |