{"id":"CVE-2017-11696","aliases":["DEBIAN-CVE-2017-11696","EUVD-2017-3306","GHSA-3mcr-pwj8-hwgr","UBUNTU-CVE-2017-11696"],"status":"published","title":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network...","description":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0073,"percentile":0.54532,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2017-12-27T19:00:00Z","modified":"2026-10-21T23:00:13Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.100-1","2:3.101-1","2:3.102-1","2:3.103-1","2:3.105-1","2:3.105-2","2:3.106-1","2:3.107-1","2:3.108-1","2:3.109-1","2:3.110-1","2:3.111-1","2:3.112-1","2:3.114-1","2:3.116-1","2:3.117-1","2:3.119-1","2:3.120-1","2:3.121-1","2:3.123-1","2:3.123.1-1","2:3.124-1","2:3.126-1","2:3.127-1","2:3.87.1-1","2:3.87.1-1+deb12u1","2:3.87.1-1+deb12u2","2:3.87.1-1+deb12u3","2:3.87.1-1+deb12u4","2:3.87.1-1+x32","2:3.89-1","2:3.89-2","2:3.90-1","2:3.90-2","2:3.90-3","2:3.91-1","2:3.92-1","2:3.93-1","2:3.94-1","2:3.95-1","2:3.96.1-1","2:3.98-1","2:3.99-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.110-1","2:3.110-1+deb13u1","2:3.110-1+deb13u2","2:3.110-1+deb13u3","2:3.110-1+deb13u4","2:3.111-1","2:3.112-1","2:3.114-1","2:3.116-1","2:3.117-1","2:3.119-1","2:3.120-1","2:3.121-1","2:3.123-1","2:3.123.1-1","2:3.124-1","2:3.126-1","2:3.127-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.110-1","2:3.111-1","2:3.112-1","2:3.114-1","2:3.116-1","2:3.117-1","2:3.119-1","2:3.120-1","2:3.121-1","2:3.123-1","2:3.123.1-1","2:3.124-1","2:3.126-1","2:3.127-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.15.1-1ubuntu1","2:3.15.2-1","2:3.15.3-1","2:3.15.3.1-1","2:3.15.3.1-1.1","2:3.15.3.1-1.1ubuntu1","2:3.15.4-1ubuntu3","2:3.15.4-1ubuntu4","2:3.15.4-1ubuntu5","2:3.15.4-1ubuntu6","2:3.15.4-1ubuntu7","2:3.15.4-1ubuntu7.1","2:3.17-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.2","2:3.17.4-0ubuntu0.14.04.1","2:3.19.2-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.2","2:3.21-0ubuntu0.14.04.1","2:3.21-0ubuntu0.14.04.2","2:3.23-0ubuntu0.14.04.1","2:3.26.2-0ubuntu0.14.04.3","2:3.28.4-0ubuntu0.14.04.1","2:3.28.4-0ubuntu0.14.04.2","2:3.28.4-0ubuntu0.14.04.3","2:3.28.4-0ubuntu0.14.04.4","2:3.28.4-0ubuntu0.14.04.5","2:3.28.4-0ubuntu0.14.04.5+esm1","2:3.28.4-0ubuntu0.14.04.5+esm2","2:3.28.4-0ubuntu0.14.04.5+esm3","2:3.28.4-0ubuntu0.14.04.5+esm4","2:3.28.4-0ubuntu0.14.04.5+esm5","2:3.28.4-0ubuntu0.14.04.5+esm6","2:3.28.4-0ubuntu0.14.04.5+esm7","2:3.28.4-0ubuntu0.14.04.5+esm8","2:3.28.4-0ubuntu0.14.04.5+esm9","2:3.28.4-0ubuntu0.14.04.5+esm10","2:3.28.4-0ubuntu0.14.04.5+esm11","2:3.28.4-0ubuntu0.14.04.5+esm12","2:3.28.4-0ubuntu0.14.04.5+esm13","2:3.28.4-0ubuntu0.14.04.5+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.19.2-1ubuntu1","2:3.19.2.1-0ubuntu1","2:3.21-1ubuntu2","2:3.21-1ubuntu3","2:3.21-1ubuntu4","2:3.23-0ubuntu0.16.04.1","2:3.26.2-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.1","2:3.28.4-0ubuntu0.16.04.2","2:3.28.4-0ubuntu0.16.04.3","2:3.28.4-0ubuntu0.16.04.4","2:3.28.4-0ubuntu0.16.04.5","2:3.28.4-0ubuntu0.16.04.6","2:3.28.4-0ubuntu0.16.04.8","2:3.28.4-0ubuntu0.16.04.9","2:3.28.4-0ubuntu0.16.04.10","2:3.28.4-0ubuntu0.16.04.11","2:3.28.4-0ubuntu0.16.04.12","2:3.28.4-0ubuntu0.16.04.13","2:3.28.4-0ubuntu0.16.04.14","2:3.28.4-0ubuntu0.16.04.14+esm1","2:3.28.4-0ubuntu0.16.04.14+esm2","2:3.28.4-0ubuntu0.16.04.14+esm3","2:3.28.4-0ubuntu0.16.04.14+esm4","2:3.28.4-0ubuntu0.16.04.14+esm5","2:3.28.4-0ubuntu0.16.04.14+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.32-1ubuntu3","2:3.34-1ubuntu1","2:3.35-2ubuntu2","2:3.35-2ubuntu2.1","2:3.35-2ubuntu2.2","2:3.35-2ubuntu2.3","2:3.35-2ubuntu2.5","2:3.35-2ubuntu2.6","2:3.35-2ubuntu2.7","2:3.35-2ubuntu2.8","2:3.35-2ubuntu2.9","2:3.35-2ubuntu2.11","2:3.35-2ubuntu2.12","2:3.35-2ubuntu2.13","2:3.35-2ubuntu2.14","2:3.35-2ubuntu2.15","2:3.35-2ubuntu2.16","2:3.35-2ubuntu2.16+esm1","2:3.35-2ubuntu2.16+esm2"]}],"products":[{"vendor":"mozilla","product":"network_security_services"}],"references":[{"url":"http://www.securitytracker.com/id/1039153","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/100345","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.geeknik.net/9brdqk6xu","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/143735/NSS-Buffer-Overflows-Floating-Point-Exception.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://seclists.org/fulldisclosure/2017/Aug/17","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Mailing List","Third Party Advisory","advisory","article","evidence","report"]},{"url":"https://security.gentoo.org/glsa/202003-37","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11696"},{"url":"https://github.com/advisories/GHSA-3mcr-pwj8-hwgr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-11696","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-11696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11696","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-11696","description":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.","status":"published","published":"2017-12-27T19:00:00Z","modified":"2024-08-05T18:19:38.411Z","updated_at":"2026-11-02T14:33:19.848632Z"}],"euvd":[{"id":"EUVD-2017-3306","description":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.","status":"published","published":"2017-12-27T19:00:00Z","modified":"2024-08-05T18:19:38Z","updated_at":"2026-11-03T02:23:22.6605Z"}],"ghsa":[{"id":"GHSA-3mcr-pwj8-hwgr","title":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network...","description":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.","status":"published","published":"2022-05-13T01:27:56Z","modified":"2023-02-01T05:07:55Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:38.356016Z"}],"nvd":[{"id":"CVE-2017-11696","description":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.","status":"published","published":"2017-12-27T19:29:00.567Z","modified":"2026-06-17T01:02:13.533Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"CVE-2017-11696","description":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.","status":"published","published":"2017-12-27T19:29:00Z","modified":"2026-04-10T03:58:28.558296Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-11696","description":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.","status":"published","published":"2017-12-27T19:29:00.567Z","modified":"2026-09-01T20:03:41.86757541Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-11696","description":"Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.","status":"published","published":"2017-12-27T19:29:00Z","modified":"2026-10-21T23:00:13.98178385Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:13.729565Z"}]}}