CVE-2012-0441

EUVD-2012-0473

05.06.2012, 23:55

The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5 UNKNOWN	NETWORK	LOW		AV:N/AC:L/Au:N/C:N/I:N/A:P

Base Score

CVSS 3.x

EPSS Score

Percentile: 87%

Affected Products (NVD)

Vendor	Product	Version
mozilla	firefox	4.0
mozilla	firefox	4.0:beta1
mozilla	firefox	4.0:beta10
mozilla	firefox	4.0:beta11
mozilla	firefox	4.0:beta12
mozilla	firefox	4.0:beta2
mozilla	firefox	4.0:beta3
mozilla	firefox	4.0:beta4
mozilla	firefox	4.0:beta5
mozilla	firefox	4.0:beta6
mozilla	firefox	4.0:beta7
mozilla	firefox	4.0:beta8
mozilla	firefox	4.0:beta9
mozilla	firefox	4.0.1
mozilla	firefox	5.0
mozilla	firefox	5.0.1
mozilla	firefox	6.0
mozilla	firefox	6.0.1
mozilla	firefox	6.0.2
mozilla	firefox	7.0
mozilla	firefox	7.0.1
mozilla	firefox	8.0
mozilla	firefox	8.0.1
mozilla	firefox	9.0
mozilla	firefox	9.0.1
mozilla	firefox	10.0
mozilla	firefox	10.0.1
mozilla	firefox	10.0.2
mozilla	firefox	10.0.3
mozilla	firefox	10.0.4
mozilla	firefox	11.0
mozilla	firefox	12.0
mozilla	firefox	12.0:beta6
mozilla	network_security_services	𝑥 ≤ 3.12.3
mozilla	network_security_services	3.2
mozilla	network_security_services	3.2.1
mozilla	network_security_services	3.3
mozilla	network_security_services	3.3.1
mozilla	network_security_services	3.3.2
mozilla	network_security_services	3.4
mozilla	network_security_services	3.4.1
mozilla	network_security_services	3.4.2
mozilla	network_security_services	3.5
mozilla	network_security_services	3.6
mozilla	network_security_services	3.6.1
mozilla	network_security_services	3.7
mozilla	network_security_services	3.7.1
mozilla	network_security_services	3.7.2
mozilla	network_security_services	3.7.3
mozilla	network_security_services	3.7.5
mozilla	network_security_services	3.7.7
mozilla	network_security_services	3.8
mozilla	network_security_services	3.9
mozilla	network_security_services	3.11.2
mozilla	network_security_services	3.11.3
mozilla	network_security_services	3.11.4
mozilla	network_security_services	3.11.5
mozilla	network_security_services	3.12
mozilla	network_security_services	3.12.1
mozilla	network_security_services	3.12.2
mozilla	seamonkey	𝑥 ≤ 2.9
mozilla	seamonkey	1.0
mozilla	seamonkey	1.0:alpha
mozilla	seamonkey	1.0:beta
mozilla	seamonkey	1.0.1
mozilla	seamonkey	1.0.2
mozilla	seamonkey	1.0.3
mozilla	seamonkey	1.0.4
mozilla	seamonkey	1.0.5
mozilla	seamonkey	1.0.6
mozilla	seamonkey	1.0.7
mozilla	seamonkey	1.0.8
mozilla	seamonkey	1.0.9
mozilla	seamonkey	1.1
mozilla	seamonkey	1.1:alpha
mozilla	seamonkey	1.1:beta
mozilla	seamonkey	1.1.1
mozilla	seamonkey	1.1.2
mozilla	seamonkey	1.1.3
mozilla	seamonkey	1.1.4
mozilla	seamonkey	1.1.5
mozilla	seamonkey	1.1.6
mozilla	seamonkey	1.1.7
mozilla	seamonkey	1.1.8
mozilla	seamonkey	1.1.9
mozilla	seamonkey	1.1.10
mozilla	seamonkey	1.1.11
mozilla	seamonkey	1.1.12
mozilla	seamonkey	1.1.13
mozilla	seamonkey	1.1.14
mozilla	seamonkey	1.1.15
mozilla	seamonkey	1.1.16
mozilla	seamonkey	1.1.17
mozilla	seamonkey	1.1.18
mozilla	seamonkey	1.1.19
mozilla	seamonkey	1.5.0.8
mozilla	seamonkey	1.5.0.9
mozilla	seamonkey	1.5.0.10
mozilla	seamonkey	2.0
mozilla	seamonkey	2.0:alpha_1
mozilla	seamonkey	2.0:alpha_2
mozilla	seamonkey	2.0:alpha_3
mozilla	seamonkey	2.0:beta_1
mozilla	seamonkey	2.0:beta_2
mozilla	seamonkey	2.0:rc1
mozilla	seamonkey	2.0:rc2
mozilla	seamonkey	2.0.1
mozilla	seamonkey	2.0.2
mozilla	seamonkey	2.0.3
mozilla	seamonkey	2.0.4
mozilla	seamonkey	2.0.5
mozilla	seamonkey	2.0.6
mozilla	seamonkey	2.0.7
mozilla	seamonkey	2.0.8
mozilla	seamonkey	2.0.9
mozilla	seamonkey	2.0.10
mozilla	seamonkey	2.0.11
mozilla	seamonkey	2.0.12
mozilla	seamonkey	2.0.13
mozilla	seamonkey	2.0.14
mozilla	seamonkey	2.1
mozilla	seamonkey	2.1:alpha1
mozilla	seamonkey	2.1:alpha2
mozilla	seamonkey	2.1:alpha3
mozilla	seamonkey	2.1:beta1
mozilla	seamonkey	2.1:beta2
mozilla	seamonkey	2.1:beta3
mozilla	seamonkey	2.1:rc1
mozilla	seamonkey	2.1:rc2
mozilla	seamonkey	2.2
mozilla	seamonkey	2.2:beta1
mozilla	seamonkey	2.2:beta2
mozilla	seamonkey	2.2:beta3
mozilla	seamonkey	2.3
mozilla	seamonkey	2.3:beta1
mozilla	seamonkey	2.3:beta2
mozilla	seamonkey	2.3:beta3
mozilla	seamonkey	2.3.1
mozilla	seamonkey	2.3.2
mozilla	seamonkey	2.3.3
mozilla	seamonkey	2.4
mozilla	seamonkey	2.4:beta1
mozilla	seamonkey	2.4:beta2
mozilla	seamonkey	2.4:beta3
mozilla	seamonkey	2.4.1
mozilla	seamonkey	2.5
mozilla	seamonkey	2.5:beta1
mozilla	seamonkey	2.5:beta2
mozilla	seamonkey	2.5:beta3
mozilla	seamonkey	2.5:beta4
mozilla	seamonkey	2.6
mozilla	seamonkey	2.6:beta1
mozilla	seamonkey	2.6:beta2
mozilla	seamonkey	2.6:beta3
mozilla	seamonkey	2.6:beta4
mozilla	seamonkey	2.6.1
mozilla	seamonkey	2.7
mozilla	seamonkey	2.7:beta1
mozilla	seamonkey	2.7:beta2
mozilla	seamonkey	2.7:beta3
mozilla	seamonkey	2.7:beta4
mozilla	seamonkey	2.7:beta5
mozilla	seamonkey	2.7.1
mozilla	seamonkey	2.7.2
mozilla	seamonkey	2.8
mozilla	seamonkey	2.8:beta1
mozilla	seamonkey	2.8:beta2
mozilla	seamonkey	2.8:beta3
mozilla	seamonkey	2.8:beta4
mozilla	seamonkey	2.8:beta5
mozilla	seamonkey	2.8:beta6
mozilla	seamonkey	2.9:beta1
mozilla	seamonkey	2.9:beta2
mozilla	seamonkey	2.9:beta3
mozilla	thunderbird	5.0
mozilla	thunderbird	6.0
mozilla	thunderbird	6.0.1
mozilla	thunderbird	6.0.2
mozilla	thunderbird	7.0
mozilla	thunderbird	7.0.1
mozilla	thunderbird	8.0
mozilla	thunderbird	9.0
mozilla	thunderbird	9.0.1
mozilla	thunderbird	10.0
mozilla	thunderbird	10.0.1
mozilla	thunderbird	10.0.2
mozilla	thunderbird	10.0.3
mozilla	thunderbird	10.0.4
mozilla	thunderbird	11.0
mozilla	thunderbird	12.0
mozilla	thunderbird_esr	10.0
mozilla	thunderbird_esr	10.0.1
mozilla	thunderbird_esr	10.0.2
mozilla	thunderbird_esr	10.0.3
mozilla	thunderbird_esr	10.0.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

nss

bookworm	2:3.87.1-1 fixed
bullseye	2:3.61-1+deb11u3 fixed
bullseye (security)	2:3.61-1+deb11u4 fixed
sid	2:3.105-2 fixed
trixie	2:3.105-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

firefox

hardy	ignored
lucid	Fixed 13.0+build1-0ubuntu0.10.04.1 released
natty	Fixed 13.0+build1-0ubuntu0.11.04.1 released
oneiric	Fixed 13.0+build1-0ubuntu0.11.10.1 released
precise	Fixed 13.0+build1-0ubuntu0.12.04.1 released
quantal	Fixed 14.0~b6+build2-0ubuntu2 released
raring	Fixed 14.0~b6+build2-0ubuntu2 released
saucy	Fixed 14.0~b6+build2-0ubuntu2 released

nss

hardy	ignored
lucid	Fixed 3.12.9+ckbi-1.82-0ubuntu0.10.04.4 released
natty	Fixed 3.12.9+ckbi-1.82-0ubuntu2.2 released
oneiric	Fixed 3.12.9+ckbi-1.82-0ubuntu6.1 released
precise	Fixed 3.13.1.with.ckbi.1.88-1ubuntu6.1 released
quantal	Fixed 3.13.1.with.ckbi.1.88-1ubuntu7 released
raring	Fixed 3.13.1.with.ckbi.1.88-1ubuntu7 released
saucy	Fixed 3.13.1.with.ckbi.1.88-1ubuntu7 released

seamonkey

hardy	ignored
lucid	ignored
natty	ignored
oneiric	ignored
precise	dne
quantal	dne
raring	dne
saucy	dne

thunderbird

hardy	ignored
lucid	Fixed 13.0.1+build1-0ubuntu0.10.04.1 released
natty	Fixed 13.0.1+build1-0ubuntu0.11.04.1 released
oneiric	Fixed 13.0.1+build1-0ubuntu0.11.10.1 released
precise	Fixed 13.0.1+build1-0ubuntu0.12.04.1 released
quantal	not-affected
raring	not-affected
saucy	not-affected