A vulnerability has been reported in Network Security Services (NSS), which can be exploited by malicious people to cause a DoS (Denial of Service) in an application using the library.

The vulnerability is caused due to the ASN.1 decoder not properly handling zero-length items, which can be exploited to e.g. cause a crash when handling OCSP responses.

The vulnerability is reported in versions prior to 3.13.4.

Solution
Update to version 3.13.4 or later.

Provided and/or discovered by
Kaspar Brand.

Original Advisory
http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=keydb.c&branch=&root=/cvsroot&subdir=mozilla/security/nss/lib/softoken/legacydb&command=DIFF_FRAMESET&rev1=1.12&rev2=1.13
http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&root=/cvsroot&subdir=mozilla/security/nss/lib/softoken/legacydb&command=DIFF_FRAMESET&root=/cvsroot&file=lowkey.c&rev1=1.5&rev2=1.6

Deep Links
Links available to Secunia VIM customers