Mozilla Network Security Services up to 3.36.6/3.41.0 Signature denial of service

Summaryinfo

A vulnerability was found in Mozilla Network Security Services up to 3.36.6/3.41.0. It has been rated as problematic. This vulnerability affects unknown code of the component Signature Handler. Performing a manipulation results in denial of service. This vulnerability is known as CVE-2018-18508. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Mozilla Network Security Services up to 3.36.6/3.41.0 (Web Browser). This affects an unknown function of the component Signature Handler. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability.

The weakness was published 10/23/2020. The advisory is shared at developer.mozilla.org. This vulnerability is uniquely identified as CVE-2018-18508. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 197382 (Ubuntu Security Notification for Nss Vulnerability (USN-3898-1)).

Upgrading to version 3.36.7 or 3.41.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Network Security Services

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.36.0
• 3.36.1
• 3.36.2
• 3.36.3
• 3.36.4
• 3.36.5
• 3.36.6
• 3.37
• 3.38
• 3.39
• 3.40
• 3.41.0

License

• open-source

Website

• Vendor: https://www.mozilla.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion