| Package | Affected versions | Patched versions |
|---|---|---|
| network security services | = 3.11.2= 3.11.3= 3.11.4= 3.11.5= 3.12= 3.12.1= 3.12.10= 3.12.11= 3.12.2= 3.12.3= 3.12.3.1= 3.12.3.2= 3.12.4= 3.12.5= 3.12.6= 3.12.7= 3.12.8= 3.12.9= 3.14= 3.14.1= 3.14.2= 3.14.3= 3.14.4= 3.14.5= 3.15= 3.15.1= 3.15.2= 3.15.3= 3.15.3.1= 3.15.4= 3.2= 3.2.1= 3.3= 3.3.1= 3.3.2= 3.4= 3.4.1= 3.4.2= 3.5= 3.6= 3.6.1= 3.7= 3.7.1= 3.7.2= 3.7.3= 3.7.5= 3.7.7= 3.8= 3.9≤ 3.15.5 |
The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free