Heap Overflow Vulnerability in NSS Affects Multiple Applications

CVE-2021-43527

Summary

NSS versions earlier than 3.73 and 3.68.1 ESR are susceptible to a heap overflow vulnerability when processing DER-encoded DSA or RSA-PSS signatures. This could potentially affect applications utilizing NSS for signature verification in formats such as CMS, S/MIME, PKCS #7, or PKCS #12. Notably, email clients like Thunderbird and LibreOffice, along with PDF viewers such as Evince and Evolution, may be impacted. Applications employing NSS for certificate validation or TLS operations can also be vulnerable, contingent upon their specific configurations.

References