CVE-2015-7182

Publication date 4 November 2015

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

Description

Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.

Status

Package Ubuntu Release Status
firefox 15.10 wily
Fixed in 42.0+build2-0ubuntu0.15.10.1
15.04 vivid
Fixed in 42.0+build2-0ubuntu0.15.04.1
14.04 LTS trusty
Fixed in 42.0+build2-0ubuntu0.14.04.1
12.04 LTS precise
Fixed in 42.0+build2-0ubuntu0.12.04.1
nss 15.10 wily
Fixed in 2:3.19.2.1-0ubuntu0.15.10.1
15.04 vivid
Fixed in 2:3.19.2.1-0ubuntu0.15.04.1
14.04 LTS trusty
Fixed in 2:3.19.2.1-0ubuntu0.14.04.1
12.04 LTS precise
Fixed in 3.19.2.1-0ubuntu0.12.04.1
thunderbird 15.10 wily
Fixed in 1:38.4.0+build3-0ubuntu0.15.10.1
15.04 vivid
Fixed in 1:38.4.0+build3-0ubuntu0.15.04.1
14.04 LTS trusty
Fixed in 1:38.4.0+build3-0ubuntu0.14.04.1
12.04 LTS precise
Fixed in 1:38.4.0+build3-0ubuntu0.12.04.1

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
nss

Severity score breakdown

CVSS version: CVSS v3.0

Base score 9.8 · Critical

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-2785-1
    • Firefox vulnerabilities
    • 4 November 2015
    • USN-2819-1
    • Thunderbird vulnerabilities
    • 1 December 2015

Other references

Access our resources on patching vulnerabilities