Multiple Mozilla products contain a flaw in the ASN.1 decoder in the QuickDER decoder of Mozilla Network Security Services that may allow a remote denial of service. The issue is triggered when handling a zero-length basic constraint or a zero-length field in an OCSP response. This will result in a loss of availability for the program.

Upgrade Firefox or Thunderbird to version 13 or 10.0.5 for ESR, SeaMonkey to version 2.10 or higher, and Network Security Services to version 3.13.4 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1027120 1027122 1027123
• CVE ID: 2012-0441 (see also: NVD)
• Secunia Advisory ID: 49288 49366 49367 49368 49446 49507 49641 49672 49976 50316 51766
• Bugtraq ID: 53798
• Vendor Specific Solution URL: http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=keydb.c&branch=&root=/cvsroot&subdir=mozilla/security/nss/lib/softoken/legacydb&command=DIFF_FRAMESET&rev1=1.12&rev2=1.13
  http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&root=/cvsroot&subdir=mozilla/security/nss/lib/softoken/legacydb&command=DIFF_FRAMESET&root=/cvsroot&file=lowkey.c&rev1=1.5&rev2=1.6
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00012.html
  http://www.debian.org/security/2012/dsa-2490
  http://www.gentoo.org/security/en/glsa/glsa-201301-01.xml
  http://www.mozilla.org/security/announce/2012/mfsa2012-39.html
  http://www.ubuntu.com/usn/usn-1463-1
  http://www.ubuntu.com/usn/usn-1463-4/
  https://bugzilla.mozilla.org/show_bug.cgi?id=715073 [ Auth Req'd ]
  https://hermes.opensuse.org/messages/14941334
• Other Advisory URL: http://www.ubuntu.com/usn/USN-1540-1
  http://www.ubuntu.com/usn/USN-1540-2
• RedHat RHSA: RHSA-2012:1090 RHSA-2012:1091

• Kaspar Brand