CVE-2017-5461

An out-of-bounds write flaw was found in the way NSS performed certain Base64-decoding operations. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library.

The security flaw exists in NSS library Base64 encoder/decoder code. Any application which uses NSS library to parse base64 encoded data could possibly be affected by the flaw. For example:

1. Servers compiled against NSS which parse untrusted certificates or any other base64 encoded data from its users.

2. Utilities like curl etc which use NSS to parse user provided base64 encoded certificates.

3. Applications like Firefox which use NSS to parse client-certificates before passing them to the web server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.