Critical DLA-3937-1 3 CVEs

nss - security update

Published Oct 27, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	nss	2:3.61-1+deb11u4

Vulnerabilities 3

Critical 9.8

CVE-2024-6602

Memory corruption in NSS

A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi

Jul 9, 2024
High 8.8

CVE-2024-6609

Memory corruption in NSS

When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird < 128.

Mozilla Firefox Thunderbird mozjs38 Browsers Debian Ubuntu Wolfi

Jul 9, 2024
High 7.5

CVE-2024-0743

An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability a…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jan 23, 2024