CVE-2019-17006: Mozilla Network Security Services

Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days.

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

Affected products

• Mozilla Network Security Services: before 3.46 (fixed in 3.46)
• Netapp Hci Compute Node: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Hci Storage Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Siemens Ruggedcom Rox MX5000 Firmware: before 2.14.0 (fixed in 2.14.0)
• Siemens Ruggedcom Rox RX1400 Firmware: before 2.14.0 (fixed in 2.14.0)
• Siemens Ruggedcom Rox RX1500 Firmware: before 2.14.0 (fixed in 2.14.0)
• Siemens Ruggedcom Rox RX1501 Firmware: before 2.14.0 (fixed in 2.14.0)
• Siemens Ruggedcom Rox RX1510 Firmware: before 2.14.0 (fixed in 2.14.0)
• Siemens Ruggedcom Rox RX1511 Firmware: before 2.14.0 (fixed in 2.14.0)
• Siemens Ruggedcom Rox RX1512 Firmware: before 2.14.0 (fixed in 2.14.0)
• Siemens Ruggedcom Rox RX5000 Firmware: before 2.14.0 (fixed in 2.14.0)

Published 2020-10-22. Last modified 2026-06-17.