CVE-2016-1978

NameCVE-2016-1978
DescriptionUse-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-480-1, DSA-3688-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nss (PTS)buster2:3.42.1-1+deb10u5fixed
buster (security)2:3.42.1-1+deb10u8fixed
bullseye (security), bullseye2:3.61-1+deb11u3fixed
bookworm2:3.87.1-1fixed
sid, trixie2:3.99-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceweaselsourcewheezy(not affected)
iceweaselsourcejessie(not affected)
iceweaselsource(unstable)44.0-1
nsssourcewheezy2:3.14.5-1+deb7u6DLA-480-1
nsssourcejessie2:3.26-1+debu8u1DSA-3688-1
nsssource(unstable)2:3.21-1

Notes

[jessie] - iceweasel <not-affected> (Only affects Firefox 43.x)
[wheezy] - iceweasel <not-affected> (Only affects Firefox 43.x)
Marked as fixed in 44.0-1 which would be the version fixing
the issue while using the bundled nss version. iceweasel for
unstable though used the system library.
https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/

Search for package or bug name: Reporting problems