CVE-2021-43527: mozilla nss +9 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-43527

CVSS 9.8 · Critical EPSS 17,6%

Kerentanan Out-of-bounds Write pada mozilla nss, mozilla nss esr +8 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

Rincian

Terbit di NVD: 8 Desember 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
EPSS (30 hari): 17,6% peluang dieksploitasi; lebih tinggi dari 97,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mozilla	nss	Semua versi sebelum 3.73
mozilla	nss esr	Semua versi sebelum 3.68.1
netapp	cloud backup	Semua versi
netapp	e-series santricity os controller	Versi 11.0 hingga 11.70.1
oracle	communications cloud native core binding support function	Versi 1.11.0
oracle	communications cloud native core network repository function	Versi 1.15.0
oracle	communications cloud native core network repository function	Versi 1.15.1
oracle	communications cloud native core network slice selection function	Versi 1.8.0
oracle	communications policy management	Versi 12.6.0.0.0
starwindsoftware	starwind san & nas	Versi v8r13
starwindsoftware	starwind virtual san	Versi v8r13 14398

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugzilla.mozilla.org/show_bug.cgi?id=1737470 issue tracking · permissions required · advisory vendor
https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_68_1_RTM/ advisory vendor
https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_73_RTM/ advisory vendor
https://www.mozilla.org/security/advisories/mfsa2021-51/ advisory vendor
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
https://cert-portal.siemens.com/productcert/pdf/ssa-594438.pdf advisory pihak ketiga
https://security.gentoo.org/glsa/202212-05 advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20211229-0002/ advisory pihak ketiga
https://www.starwindsoftware.com/security/sw-20220802-0001/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.