## mfsa2021-51.yml
announced: December 1, 2021
impact: critical
fixed_in:
- NSS 3.68.1
- NSS 3.73
title: Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures
advisories:
  CVE-2021-43527:
    title: Memory corruption via DER-encoded DSA and RSA-PSS signatures
    impact: critical
    reporter: Tavis Ormandy of Google Project Zero
    description: |
      NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. <br>*Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.
    bugs:
      - url: 1737470

## mfsa2021-51.yml
announced: December 1, 2021
impact: critical
fixed_in:
- NSS 3.68.1
- NSS 3.73
title: Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures
advisories:
  CVE-2021-43527:
    title: Memory corruption via DER-encoded DSA and RSA-PSS signatures
    impact: critical
    reporter: Tavis Ormandy of Google Project Zero
    description: |
      NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. <br>*Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.
    bugs:
      - url: 1737470
      - url: https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_73_RTM/
        desc: NSS 3.73
      - url: https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_68_1_RTM/
        desc: NSS 3.68.1

Add links to the releases
Add links to the releases
