Old CVEs

Charles Robertson <[email protected]> Thu, 7 Nov 2019 22:15:46 +0000

Newsgroups	gmane.comp.mozilla.security
Message-ID	<DM6PR18MB2379C2DE2FE275753A05ABF4CF780@DM6PR18MB2379.namprd18.prod.outlook.com>

Hi,

What is the status of the following CVEs on NSS? I've searched through all your MFSAs and did not find these.

CVE-2017-11695: heap-buffer-overflow (write of size 8) in alloc_segs (lib/dbm/src/hash.c:1105)
https://bugzilla.mozilla.org/show_bug.cgi?id=1360782

CVE-2017-11696: heap-buffer-overflow (write of size 65544) in __hash_open (lib/dbm/src/hash.c:241)
https://bugzilla.mozilla.org/show_bug.cgi?id=1360778

CVE-2017-11697: Floating Point Exception in __hash_open (hash.c:229)
https://bugzilla.mozilla.org/show_bug.cgi?id=1360900

CVE-2017-11698: heap-buffer-overflow (write of size 2) in __get_page (lib/dbm/src/h_page.c:704)
https://bugzilla.mozilla.org/show_bug.cgi?id=1360779

Are they ever going to be fixed?

Charles Robertson
Firefox Maintainer
SUSE LLC