CVE-2021-43527 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	High
Remote	Yes
Type	Arbitrary code execution
Description	NSS (Network Security Services) versions prior to 3.73 are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-2597	lib32-nss	3.72-2	3.73-1	High	Fixed
AVG-2596	nss	3.72-2	3.73-1	High	Fixed

Date	Advisory	Group	Package	Severity	Type
03 Dec 2021	ASA-202112-4	AVG-2597	lib32-nss	High	arbitrary code execution
03 Dec 2021	ASA-202112-3	AVG-2596	nss	High	arbitrary code execution

References
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/#CVE-2021-43527 https://bugs.chromium.org/p/project-zero/issues/detail?id=2237 https://bugzilla.mozilla.org/show_bug.cgi?id=1737470 https://hg.mozilla.org/projects/nss/rev/6b3dc97a8767d9dc5c4c181597d1341d0899aa58

References

https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/#CVE-2021-43527
https://bugs.chromium.org/p/project-zero/issues/detail?id=2237
https://bugzilla.mozilla.org/show_bug.cgi?id=1737470
https://hg.mozilla.org/projects/nss/rev/6b3dc97a8767d9dc5c4c181597d1341d0899aa58