CVE-2012-0441
Medium
Description
The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response.
SeverityMedium
CVSS5.0
Exploit probability—
Product
Mozilla Firefox
PublishedJun 5, 2012
First seenJun 5, 2012
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla firefox | 4.0, 4.0.1, 5.0, 5.0.1, 6.0, 6.0.1, 6.0.2, 7.0, 7.0.1, 8.0, 8.0.1, 9.0, 9.0.1, 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 11.0, 12.0 | — |
| mozilla network_security_services | v ≤ 3.12.3, 3.2, 3.2.1, 3.3, 3.3.1, 3.3.2, 3.4, 3.4.1, 3.4.2, 3.5, 3.6, 3.6.1, 3.7, 3.7.1, 3.7.2, 3.7.3, 3.7.5, 3.7.7, 3.8, 3.9, 3.11.2, 3.11.3, 3.11.4, 3.11.5, 3.12, 3.12.1, 3.12.2 | — |
| mozilla seamonkey | v ≤ 2.9, 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 1.1.12, 1.1.13, 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.18, 1.1.19, 1.5.0.8, 1.5.0.9, 1.5.0.10, 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.1, 2.2, 2.3, 2.3.1, 2.3.2, 2.3.3, 2.4, 2.4.1, 2.5, 2.6, 2.6.1, 2.7, 2.7.1, 2.7.2, 2.8, 2.9 | — |
| mozilla thunderbird | 5.0, 6.0, 6.0.1, 6.0.2, 7.0, 7.0.1, 8.0, 9.0, 9.0.1, 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 11.0, 12.0 | — |
| mozilla thunderbird_esr | 10.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.