CVE-2019-17006

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 3.6%

exploitation probability

3.6%top 11% of all CVEs

observed exploitation

nono source reports it

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Affected products

Mozilla · NSS

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1539788 https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes https://security.netapp.com/advisory/ntap-20210129-0001/https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04