SB2017081502 - Arbitrary code execution in Mozilla NSS
Published: August 15, 2017 Updated: August 20, 2020
Security Bulletin ID
SB2017081502
Severity
Low
Patch available
YES
Number of vulnerabilities
4
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2017-11695)
The vulnerability allows a local attacker to gain elevated privileges.The weakness exists due to heap-based buffer overflow in alloc_segs() in 'lib/dbm/src/hash.c'. A local attacker supply a specially crafted 'cert8.db' file, cause is to be processed by the NSS 'certutil' application and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
2) Heap-based buffer overflow (CVE-ID: CVE-2017-11696)
The vulnerability allows a local attacker to gain elevated privileges.The weakness exists due to heap-based buffer overflow in __hash_open() in 'lib/dbm/src/hash.c'. A local attacker supply a specially crafted 'cert8.db' file, cause is to be processed by the NSS 'certutil' application and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
3) Divide by zero (CVE-ID: CVE-2017-11697)
The vulnerability allows a local attacker to gain elevated privileges.The weakness exists due to floating point exception in __hash_open() in 'hash.c'. A local attacker supply a specially crafted 'cert8.db' file, cause is to be processed by the NSS 'certutil' application and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
4) Heap-based buffer overflow (CVE-ID: CVE-2017-11698)
The vulnerability allows a local attacker to gain elevated privileges.The weakness exists due to heap-based buffer overflow in __get_page() in 'lib/dbm/src/h_page.c'. A local attacker supply a specially crafted 'cert8.db' file, cause is to be processed by the NSS 'certutil' application and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.