Description
Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nspr | 2:4.10.2-1 | — |
| Debian 13 | nspr | 2:4.10.2-1 | — |
| Debian 12 | nspr | 2:4.10.2-1 | — |
| Debian 7 | nspr | 2:4.9.2-1+deb7u1 | DSA-2820-1 |
| Debian 6.0 | nspr | 4.8.6-1+squeeze1 | DSA-2820-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | nspr +1 | 4.10.2-1.el6_5 | RHSA-2013:1829 |
| RHEL 6 | nss +4 | 3.15.3-2.el6_5 | RHSA-2013:1829 |
| RHEL 6 | nss-util +1 | 3.15.3-1.el6_5 | RHSA-2013:1829 |
| RHEL 5 | nspr +1 | 4.10.2-2.el5_10 | RHSA-2013:1791 |
| RHEL 5 | nss +3 | 3.15.3-3.el5_10 | RHSA-2013:1791 |
Advisories 3
- RHSA-2013:1829 Red Hat Security Advisory: nss, nspr, and nss-util security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:1791 Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2820-1 nspr - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- DSA-2820 vendor-advisory
- GLSA-201504-01 vendor-advisory
- USN-2087-1 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=927687
- GLSA-201406-19 vendor-advisory
- USN-2031-1 vendor-advisory
- USN-2032-1 vendor-advisory
- RHSA-2013:1791 vendor-advisory
- [dev-tech-nspr] 20131113 [ANNOUNCE] NSPR 4.10.2 Release mailing-list
- SUSE-SU-2013:1807 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://www.mozilla.org/security/announce/2013/mfsa2013-103.html
- openSUSE-SU-2013:1732 vendor-advisory
- 63802 vdb-entry
- RHSA-2013:1829 vendor-advisory