CVE-2021-43527 vulnerability in Mozilla and Other Products
Published on December 8, 2021
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
Products Associated with CVE-2021-43527
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-43527 are published in these products:
Affected Versions
Mozilla NSS:- Version unspecified and below 3.73 is affected.
- Version unspecified and below 3.68.1 is affected.
Exploit Probability
EPSS
5.24%
Percentile
89.77%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.