{"id":"CVE-2015-7182","url":"https://www.cyber-defence.io/tools/cve/CVE-2015-7182","generatedAt":"2026-11-05T05:51:05.285Z","title":"Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a…","description":"Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data.","published":"2015-11-05T05:59:07.000Z","lastModified":"2026-06-17T00:31:59.000Z","status":"Modified","sourceIdentifier":"security@mozilla.org","cvss":{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-119"],"affected":["oracle/traffic director","oracle/opensso","oracle/iplanet web proxy server","mozilla/firefox","oracle/glassfish server","mozilla/network security services","oracle/iplanet web server"],"epss":{"score":0.10238,"percentile":0.95695,"date":"2026-11-04","history":[{"date":"2026-09-21","score":0.08657,"percentile":0.94932},{"date":"2026-09-22","score":0.10238,"percentile":0.95468}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 10.2%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-22T00:00:00.000Z","detail":{"to":0.10238,"from":0.08657,"percentile":0.95468},"summary":"EPSS moved from 8.7% to 10.2% probability of exploitation in the next thirty days."}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html","source":"security@mozilla.org"},{"url":"http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html","source":"security@mozilla.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1980.html","source":"security@mozilla.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1981.html","source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2015/dsa-3393","source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2015/dsa-3410","source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2016/dsa-3688","source":"security@mozilla.org"},{"url":"http://www.mozilla.org/security/announce/2015/mfsa2015-133.html","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","tags":["Patch"],"source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","source":"security@mozilla.org"},{"url":"http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","source":"security@mozilla.org"},{"url":"http://www.securityfocus.com/bid/77416","source":"security@mozilla.org"},{"url":"http://www.securityfocus.com/bid/91787","source":"security@mozilla.org"},{"url":"http://www.securitytracker.com/id/1034069","source":"security@mozilla.org"},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2785-1","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2791-1","source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-2819-1","source":"security@mozilla.org"},{"url":"https://bto.bluecoat.com/security-advisory/sa119","source":"security@mozilla.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1202868","source":"security@mozilla.org"},{"url":"https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/201512-10","source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/201605-06","source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1980.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1981.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2015/dsa-3393","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2015/dsa-3410","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2016/dsa-3688","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mozilla.org/security/announce/2015/mfsa2015-133.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/77416","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/91787","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1034069","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2785-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2791-1","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-7182","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}