CVE Feed

Dashboard / CVE / CVE-2015-7182

CVE-2015-7182

Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.

Published:Nov 3, 2015

Last Modified:Apr 12, 2025

EPS:Nov 5, 2015

EPSS Score:0.18408

CVSS Score:9.8

Affected Products

Vendor

Product

Action

Vendor

Mozilla

Product

Firefox

Mozilla

Firefox

Vendor

Mozilla

Product

Network Security Services

Mozilla

Network Security Services

Vendor

Oracle

Product

Glassfish Server

Oracle

Glassfish Server

Vendor

Oracle

Product

Iplanet Web Proxy Server

Oracle

Iplanet Web Proxy Server

Vendor

Oracle

Product

Iplanet Web Server

Oracle

Iplanet Web Server

Vendor

Oracle

Product

Opensso

Oracle

Opensso

Vendor

Oracle

Product

Traffic Director

Oracle

Traffic Director

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Rhel Aus

Redhat

Rhel Aus

Vendor

Redhat

Product

Rhel Eus

Redhat

Rhel Eus

Vendor

Redhat

Product

Rhel Mission Critical

Redhat

Rhel Mission Critical

Exploits

No exploit reference

Common Weakness Enumeration

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-122 Heap-based Buffer Overflow

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-10 Buffer Overflow via Environment Variables

CAPEC-100 Overflow Buffers

CAPEC-123 Buffer Manipulation

CAPEC-14 Client-side Injection-induced Buffer Overflow

CAPEC-24 Filter Failure through Buffer Overflow

CAPEC-42 MIME Conversion

CAPEC-44 Overflow Binary Resource File

CAPEC-45 Buffer Overflow via Symbolic Links

CAPEC-46 Overflow Variables and Tags

CAPEC-47 Buffer Overflow via Parameter Expansion

CAPEC-8 Buffer Overflow in an API Call

CAPEC-9 Buffer Overflow in Local Command-Line Utilities

CAPEC-92 Forced Integer Overflow

Related CVEs

CVE-2026-84144 (CVSS 7.5) — Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence…

CVE-2026-84143 (CVSS 9.8) — Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of th…

CVE-2026-84142 (CVSS 9.8) — Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or a…

CVE-2026-84141 (CVSS 9.8) — Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR…

CVE-2026-84140 (CVSS 9.8) — Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ES…

CVE-2026-84139 (CVSS 6.1) — Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.…

CVE-2026-84138 (CVSS 6.5) — Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155…

CVE-2026-84137 (CVSS 4.3) — Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153…

CVE-2026-84136 (CVSS 6.1) — Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, …

CVE-2026-84135 (CVSS 9.8) — Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.…

References

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html

http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html

http://rhn.redhat.com/errata/RHSA-2015-1980.html

http://rhn.redhat.com/errata/RHSA-2015-1981.html

http://www.debian.org/security/2015/dsa-3393

http://www.debian.org/security/2015/dsa-3410

http://www.debian.org/security/2016/dsa-3688

http://www.mozilla.org/security/announce/2015/mfsa2015-133.html

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://www.securityfocus.com/bid/77416

http://www.securityfocus.com/bid/91787

http://www.securitytracker.com/id/1034069

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753

http://www.ubuntu.com/usn/USN-2785-1

http://www.ubuntu.com/usn/USN-2791-1

http://www.ubuntu.com/usn/USN-2819-1

https://bto.bluecoat.com/security-advisory/sa119

https://bugzilla.mozilla.org/show_bug.cgi?id=1202868

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes

https://security.gentoo.org/glsa/201512-10

https://security.gentoo.org/glsa/201605-06

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html

http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html

http://rhn.redhat.com/errata/RHSA-2015-1980.html

http://rhn.redhat.com/errata/RHSA-2015-1981.html

http://www.debian.org/security/2015/dsa-3393

http://www.debian.org/security/2015/dsa-3410

http://www.debian.org/security/2016/dsa-3688

http://www.mozilla.org/security/announce/2015/mfsa2015-133.html

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://www.securityfocus.com/bid/77416

http://www.securityfocus.com/bid/91787

http://www.securitytracker.com/id/1034069

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753

http://www.ubuntu.com/usn/USN-2785-1

http://www.ubuntu.com/usn/USN-2791-1

http://www.ubuntu.com/usn/USN-2819-1

https://bto.bluecoat.com/security-advisory/sa119

https://bugzilla.mozilla.org/show_bug.cgi?id=1202868

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes

https://security.gentoo.org/glsa/201512-10

https://security.gentoo.org/glsa/201605-06

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High