Asymmetric denial of service In thunderbird
Description
A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: NSC_DeriveKey inadvertently assumed that the phKey parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows phKey to be NULL for certain mechanisms.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component |
|---|---|
 rpm rhel7 | |
rpm rhel8 | |
rpm rhel6 | |
rpm rhel6 | |
rpm rhel7 | |
rpm rhel8 |
Aliases
1. 2. 3.