Out-of-bounds write in Mozilla Thunderbird
Priority MEDIUM 50CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 30 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.
Why it matters now
EPSS 0.04703 91st percentileScored 2026-11-07
Fix Partial Thunderbird (Mozilla): 52.1Firefox ESR (Mozilla): 45.9, 52.1+1 more productRed Hat: 4 advisoriesRed Hat: 30 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mozilla | Thunderbird | before 52.1 | 52.1 | Patch available | CNA |
| Mozilla | Firefox ESR | before 45.9; before 52.1 | 45.9, 52.1 | Patch available | CNA |
| Mozilla | Firefox | before 53 | 53 | Patch available | CNA |
- Thunderbird VendorMozilla Affected before 52.1 Fixed in 52.1 Patch available CNA
- Firefox ESR VendorMozilla Affected before 45.9; before 52.1 Fixed in 45.9, 52.1 Patch available CNA
- Firefox VendorMozilla Affected before 53 Fixed in 53 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:* | before 3.21.4; after 3.22, before 3.28.4; 3.29 to before 3.29.5; 3.30 to before 3.30.1 | Vulnerable | Mozilla |
- cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:* Versions before 3.21.4; after 3.22, before 3.28.4; 3.29 to before 3.29.5; 3.30 to before 3.30.1 Vulnerable ·Mozilla
Remediation
- Fix · CNA Thunderbird (Mozilla) Fixed in 52.1
- Fix · CNA Firefox ESR (Mozilla) Fixed in 45.9, 52.1
- Fix · CNA Firefox (Mozilla) Fixed in 53
Red Hat 4 advisories
- RHSA-2017:1100 Released 2017-04-20 · Red Hat rating Criticalnss and nss-util security update
- Red Hat Enterprise Linux Client (v. 7) nss-3.28.4-1.0.el7_3, nss-sysinit-3.28.4-1.0.el7_3, nss-tools-3.28.4-1.0.el7_3 +1
- Red Hat Enterprise Linux Client Optional (v. 7) nss-devel-3.28.4-1.0.el7_3, nss-pkcs11-devel-3.28.4-1.0.el7_3, nss-util-devel-3.28.4-1.0.el7_3
- Red Hat Enterprise Linux ComputeNode (v. 7) nss-3.28.4-1.0.el7_3, nss-sysinit-3.28.4-1.0.el7_3, nss-tools-3.28.4-1.0.el7_3 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) nss-devel-3.28.4-1.0.el7_3, nss-pkcs11-devel-3.28.4-1.0.el7_3, nss-util-devel-3.28.4-1.0.el7_3
- Red Hat Enterprise Linux Desktop (v. 6) nss-3.28.4-1.el6_9, nss-sysinit-3.28.4-1.el6_9, nss-tools-3.28.4-1.el6_9 +1
- Red Hat Enterprise Linux Desktop Optional (v. 6) nss-devel-3.28.4-1.el6_9, nss-pkcs11-devel-3.28.4-1.el6_9, nss-util-devel-3.28.4-1.el6_9
- Red Hat Enterprise Linux HPC Node (v. 6) nss-3.28.4-1.el6_9, nss-sysinit-3.28.4-1.el6_9, nss-tools-3.28.4-1.el6_9 +1
- Red Hat Enterprise Linux HPC Node Optional (v. 6) nss-devel-3.28.4-1.el6_9, nss-pkcs11-devel-3.28.4-1.el6_9, nss-util-devel-3.28.4-1.el6_9
- Red Hat Enterprise Linux Server (v. 6) nss-3.28.4-1.el6_9, nss-3.28.4-1.el6_9.ppc, nss-devel-3.28.4-1.el6_9 +7
- Red Hat Enterprise Linux Server (v. 7) nss-3.28.4-1.0.el7_3, nss-3.28.4-1.0.el7_3.ppc, nss-devel-3.28.4-1.0.el7_3 +7
- Red Hat Enterprise Linux Server Optional (v. 6) nss-pkcs11-devel-3.28.4-1.el6_9, nss-pkcs11-devel-3.28.4-1.el6_9.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) nss-pkcs11-devel-3.28.4-1.0.el7_3, nss-pkcs11-devel-3.28.4-1.0.el7_3.ppc
- Red Hat Enterprise Linux Workstation (v. 6) nss-3.28.4-1.el6_9, nss-devel-3.28.4-1.el6_9, nss-sysinit-3.28.4-1.el6_9 +3
- Red Hat Enterprise Linux Workstation (v. 7) nss-3.28.4-1.0.el7_3, nss-devel-3.28.4-1.0.el7_3, nss-sysinit-3.28.4-1.0.el7_3 +3
- Red Hat Enterprise Linux Workstation Optional (v. 6) nss-pkcs11-devel-3.28.4-1.el6_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) nss-pkcs11-devel-3.28.4-1.0.el7_3
- RHSA-2017:1102 Released 2017-04-20 · Red Hat rating Criticalnss-util security update
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.2) nss-util-3.21.4-1.el7_2
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.2) nss-util-devel-3.21.4-1.el7_2
- Red Hat Enterprise Linux HPC Node EUS (v. 6.7) nss-util-3.21.4-1.el6_7
- Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) nss-util-devel-3.21.4-1.el6_7
- Red Hat Enterprise Linux Server AUS (v. 6.2) nss-util-3.13.1-11.el6_2, nss-util-devel-3.13.1-11.el6_2
- Red Hat Enterprise Linux Server AUS (v. 6.4) nss-util-3.14.3-9.el6_4, nss-util-devel-3.14.3-9.el6_4
- Red Hat Enterprise Linux Server AUS (v. 6.5) nss-util-3.16.1-5.el6_5, nss-util-devel-3.16.1-5.el6_5
- Red Hat Enterprise Linux Server AUS (v. 6.6) nss-util-3.19.1-4.el6_6, nss-util-devel-3.19.1-4.el6_6
- Red Hat Enterprise Linux Server EUS (v. 6.7) nss-util-3.21.4-1.el6_7, nss-util-3.21.4-1.el6_7.ppc, nss-util-devel-3.21.4-1.el6_7 +1
- Red Hat Enterprise Linux Server EUS (v. 7.2) nss-util-3.21.4-1.el7_2, nss-util-3.21.4-1.el7_2.ppc, nss-util-devel-3.21.4-1.el7_2 +1
- Red Hat Enterprise Linux Server TUS (v. 6.5) nss-util-3.16.1-5.el6_5, nss-util-devel-3.16.1-5.el6_5
- Red Hat Enterprise Linux Server TUS (v. 6.6) nss-util-3.19.1-4.el6_6, nss-util-devel-3.19.1-4.el6_6
- RHSA-2017:1101 Released 2017-04-20 · Red Hat rating Criticalnss security update
- Red Hat Enterprise Linux Server (v. 5 ELS) nss-3.21.4-1.el5_11, nss-3.21.4-1.el5_11.i386, nss-devel-3.21.4-1.el5_11 +5
Show 1 more Red Hat advisories
- RHSA-2017:1103 Released 2017-04-20 · Red Hat rating Criticalnss security update
- Red Hat Enterprise Linux Long Life (v. 5.9 server) nss-3.14.3-11.el5_9, nss-3.14.3-11.el5_9.i386, nss-devel-3.14.3-11.el5_9 +5
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 4 | Affected | No fix yet |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux ComputeNode EUS (v. 7.2) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.2) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux HPC Node EUS (v. 6.7) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Long Life (v. 5.9 server) | Fixed | RHSA-2017:1103 |
| Red Hat Enterprise Linux Server (v. 5 ELS) | Fixed | RHSA-2017:1101 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Server AUS (v. 6.2) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Server AUS (v. 6.4) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Server AUS (v. 6.5) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Server AUS (v. 6.6) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Server EUS (v. 6.7) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Server EUS (v. 7.2) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Server TUS (v. 6.5) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Server TUS (v. 6.6) | Fixed | RHSA-2017:1102 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2017:1100 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2017:1100 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5461
- 2026-10-03 Alias added: GHSA-f438-mjv4-rwx8
References
Patch 8
Advisory 9
- GLSA-201705-04
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.30.1_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.29.5_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.28.4_release_notes
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-13/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/#CVE-2017-5461
More Mozilla Network Security Services vulnerabilities
- TI-2015-03381 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server… CVSS 3.1LOW 3.7
- TI-2007-00009 Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services… CVSS 2.0MEDIUM 6.8
- TI-2018-08903 A cached side channel attack during handshakes using RSA encryption could allow for the… CVSS 3.0MEDIUM 5.9
- TI-2015-05957 Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services… CVSS 3.0CRITICAL 9.8
- TI-2004-00763 Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows… CVSS 2.0HIGH 7.5
- TI-2014-01197 Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in… CVSS 2.0HIGH 10.0
Sources
- CVE-2017-5461 · CVE Program
- CVE-2017-5461 · NVD
- FIRST EPSS
- GHSA-f438-mjv4-rwx8 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-5461 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences