Read the docs
TI-2021-19417 Aliases CVE-2021-43527GHSA-7hfm-39v6-v3p5

Out-of-bounds write in Mozilla NSS

Priority MEDIUM 59CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

Why it matters now

EPSS 0.17563 97th percentileScored 2026-11-07
Fix Fixed NSS (Mozilla): 3.73, 3.68.1Red Hat: 14 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaNSSbefore 3.73; before 3.68.13.73, 3.68.1Patch availableCNA
  • NSS VendorMozilla Affected before 3.73; before 3.68.1 Fixed in 3.73, 3.68.1 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:*before 3.73VulnerableMozilla
cpe:2.3:a:mozilla:nss_esr:*:*:*:*:*:*:*:*before 3.68.1VulnerableMozilla
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*11.0 – 11.70.1VulnerableNetApp
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:*1.15.1VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableOracle
cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:*12.6.0.0.0VulnerableOracle
cpe:2.3:a:starwindsoftware:starwind_san_\&_nas:v8r13:*:*:*:*:*:*:*v8r13VulnerableStarwindsoftware
  • cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:* Versions before 3.73 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:nss_esr:*:*:*:*:*:*:*:* Versions before 3.68.1 Vulnerable ·Mozilla
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.70.1 Vulnerable ·NetApp
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.15.1:*:*:*:*:*:*:* Versions 1.15.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_policy_management:12.6.0.0.0:*:*:*:*:*:*:* Versions 12.6.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:starwindsoftware:starwind_san_\&_nas:v8r13:*:*:*:*:*:*:* Versions v8r13 Vulnerable ·Starwindsoftware
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8r13:14398:*:*:*:*:*:*v8r13 14398VulnerableStarwindsoftware
  • cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8r13:14398:*:*:*:*:*:* Versions v8r13 14398 Vulnerable ·Starwindsoftware

Remediation

  • Fix · CNA NSS (Mozilla) Fixed in 3.73, 3.68.1

Red Hat 14 advisories

  • RHSA-2021:5035 Released 2021-12-08 · Red Hat rating Critical
    RHV-H security update (redhat-virtualization-host) 4.3.20
    • RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host-4.3.20-20211202.1.el7_9, redhat-virtualization-host-image-update-4.3.20-20211202.1.el7_9
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.3.20-20211202.1.el7_9, redhat-virtualization-host-image-update-4.3.20-20211202.1.el7_9
  • RHSA-2021:5006 Released 2021-12-08 · Red Hat rating Critical
    Red Hat Virtualization Host security and bug fix update [ovirt-4.4.9] Async #1
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.9-202112061811_8.5, redhat-virtualization-host-image-update-4.4.9-202112061811_8.5
  • RHSA-2021:4994 Released 2021-12-07 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux Server AUS (v. 7.3) nss-3.28.4-2.el7_3, nss-devel-3.28.4-2.el7_3, nss-sysinit-3.28.4-2.el7_3 +1
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) nss-pkcs11-devel-3.28.4-2.el7_3
Show 11 more Red Hat advisories
  • RHSA-2021:4969 Released 2021-12-06 · Red Hat rating Critical
    thunderbird security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) thunderbird-91.3.0-3.el8_1
  • RHSA-2021:4954 Released 2021-12-06 · Red Hat rating Critical
    thunderbird security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) thunderbird-91.3.0-3.el8_2
  • RHSA-2021:4953 Released 2021-12-06 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nss-3.44.0-10.el8_1, nss-devel-3.44.0-10.el8_1, nss-softokn-3.44.0-10.el8_1 +7
  • RHSA-2021:4946 Released 2021-12-06 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux Server AUS (v. 7.7) nss-3.44.0-8.el7_7, nss-devel-3.44.0-8.el7_7, nss-sysinit-3.44.0-8.el7_7 +1
    • Red Hat Enterprise Linux Server E4S (v. 7.7) nss-3.44.0-8.el7_7, nss-devel-3.44.0-8.el7_7, nss-sysinit-3.44.0-8.el7_7 +1
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.7) nss-pkcs11-devel-3.44.0-8.el7_7
    • Red Hat Enterprise Linux Server Optional E4S (v. 7.7) nss-pkcs11-devel-3.44.0-8.el7_7
    • Red Hat Enterprise Linux Server Optional TUS (v. 7.7) nss-pkcs11-devel-3.44.0-8.el7_7
    • Red Hat Enterprise Linux Server TUS (v. 7.7) nss-3.44.0-8.el7_7, nss-devel-3.44.0-8.el7_7, nss-sysinit-3.44.0-8.el7_7 +1
  • RHSA-2021:4933 Released 2021-12-06 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux Server AUS (v. 7.6) nss-3.36.0-10.2.el7_6, nss-devel-3.36.0-10.2.el7_6, nss-sysinit-3.36.0-10.2.el7_6 +1
    • Red Hat Enterprise Linux Server E4S (v. 7.6) nss-3.36.0-10.2.el7_6, nss-devel-3.36.0-10.2.el7_6, nss-sysinit-3.36.0-10.2.el7_6 +1
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.6) nss-pkcs11-devel-3.36.0-10.2.el7_6
    • Red Hat Enterprise Linux Server Optional E4S (v. 7.6) nss-pkcs11-devel-3.36.0-10.2.el7_6
    • Red Hat Enterprise Linux Server Optional TUS (v. 7.6) nss-pkcs11-devel-3.36.0-10.2.el7_6
    • Red Hat Enterprise Linux Server TUS (v. 7.6) nss-3.36.0-10.2.el7_6, nss-devel-3.36.0-10.2.el7_6, nss-sysinit-3.36.0-10.2.el7_6 +1
  • RHSA-2021:4932 Released 2021-12-06 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux Server AUS (v. 7.4) nss-3.28.4-18.el7_4, nss-devel-3.28.4-18.el7_4, nss-sysinit-3.28.4-18.el7_4 +1
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) nss-pkcs11-devel-3.28.4-18.el7_4
  • RHSA-2021:4919 Released 2021-12-02 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) nss-3.53.1-12.el8_2, nss-devel-3.53.1-12.el8_2, nss-softokn-3.53.1-12.el8_2 +7
  • RHSA-2021:4909 Released 2021-12-02 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nss-3.67.0-7.el8_4, nss-devel-3.67.0-7.el8_4, nss-softokn-3.67.0-7.el8_4 +7
  • RHSA-2021:4907 Released 2021-12-01 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux Server (v. 6 ELS) nss-3.44.0-12.el6_10, nss-devel-3.44.0-12.el6_10, nss-sysinit-3.44.0-12.el6_10 +1
    • Red Hat Enterprise Linux Server Optional (v. 6 ELS) nss-pkcs11-devel-3.44.0-12.el6_10
  • RHSA-2021:4904 Released 2021-12-01 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux Client (v. 7) nss-3.67.0-4.el7_9, nss-sysinit-3.67.0-4.el7_9, nss-tools-3.67.0-4.el7_9
    • Red Hat Enterprise Linux Client Optional (v. 7) nss-devel-3.67.0-4.el7_9, nss-pkcs11-devel-3.67.0-4.el7_9
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) nss-devel-3.67.0-4.el7_9, nss-pkcs11-devel-3.67.0-4.el7_9
    • Red Hat Enterprise Linux Server (v. 7) nss-3.67.0-4.el7_9, nss-3.67.0-4.el7_9.ppc, nss-devel-3.67.0-4.el7_9 +3
    • Red Hat Enterprise Linux Server Optional (v. 7) nss-pkcs11-devel-3.67.0-4.el7_9, nss-pkcs11-devel-3.67.0-4.el7_9.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) nss-3.67.0-4.el7_9, nss-devel-3.67.0-4.el7_9, nss-sysinit-3.67.0-4.el7_9 +1
    • Red Hat Enterprise Linux Workstation Optional (v. 7) nss-pkcs11-devel-3.67.0-4.el7_9
  • RHSA-2021:4903 Released 2021-12-01 · Red Hat rating Critical
    nss security update
    • Red Hat Enterprise Linux AppStream (v. 8) nss-3.67.0-7.el8_5, nss-devel-3.67.0-7.el8_5, nss-softokn-3.67.0-7.el8_5 +7

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL 7-based RHEV-H for RHEV 4 (build requirements)Fixed RHSA-2021:5035
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:4903
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2021:4969
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2021:4953
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:4919, RHSA-2021:4954
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2021:4909
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2021:4904
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2021:4904
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2021:4904
Red Hat Enterprise Linux Server (v. 6 ELS)Fixed RHSA-2021:4907
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:4904
Red Hat Enterprise Linux Server AUS (v. 7.3)Fixed RHSA-2021:4994
Red Hat Enterprise Linux Server AUS (v. 7.4)Fixed RHSA-2021:4932
Red Hat Enterprise Linux Server AUS (v. 7.6)Fixed RHSA-2021:4933
Red Hat Enterprise Linux Server AUS (v. 7.7)Fixed RHSA-2021:4946
Red Hat Enterprise Linux Server E4S (v. 7.6)Fixed RHSA-2021:4933
Red Hat Enterprise Linux Server E4S (v. 7.7)Fixed RHSA-2021:4946
Red Hat Enterprise Linux Server Optional (v. 6 ELS)Fixed RHSA-2021:4907
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2021:4904
Red Hat Enterprise Linux Server Optional AUS (v. 7.3)Fixed RHSA-2021:4994
Red Hat Enterprise Linux Server Optional AUS (v. 7.4)Fixed RHSA-2021:4932
Red Hat Enterprise Linux Server Optional AUS (v. 7.6)Fixed RHSA-2021:4933
Red Hat Enterprise Linux Server Optional AUS (v. 7.7)Fixed RHSA-2021:4946
Red Hat Enterprise Linux Server Optional E4S (v. 7.6)Fixed RHSA-2021:4933
Red Hat Enterprise Linux Server Optional E4S (v. 7.7)Fixed RHSA-2021:4946
Red Hat Enterprise Linux Server Optional TUS (v. 7.6)Fixed RHSA-2021:4933
Red Hat Enterprise Linux Server Optional TUS (v. 7.7)Fixed RHSA-2021:4946
Red Hat Enterprise Linux Server TUS (v. 7.6)Fixed RHSA-2021:4933
Red Hat Enterprise Linux Server TUS (v. 7.7)Fixed RHSA-2021:4946
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:4904
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2021:4904
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2021:5035
Red Hat Virtualization 4 Hypervisor for RHEL 8Fixed RHSA-2021:5006
Not affected: 6 products
  • RHEL 7-based RHEV-H for RHEV 4 (build requirements)
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43527
  2. 2026-10-03 Alias added: GHSA-7hfm-39v6-v3p5

References

Patch 1

Advisory 8

  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2020-09921 Out-of-bounds read in nss CVSS 3.1CRITICAL 9.1
  • TI-2016-04582 NULL pointer dereference in Mozilla Network Security Services CVSS 3.1HIGH 7.5
  • TI-2016-01772 The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS)… CVSS 3.0MEDIUM 6.5
  • TI-2023-04081 Observable discrepancy in Mozilla NSS CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences