Package Instance

Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team reported an out of bounds write in the 
Netscape 
Portable Runtime (NSPR) leading to a potentially exploitable crash or code
execution. This issue is fixed in NSPR version 4.10.6.
This NSPR flaw was not exposed to web content in any shipped version of Firefox.

Mozilla engineers Tyson Smith and David Keeler
reported a use-after-poison and buffer overflow in the ASN.1 decoder in Network Security
Services (NSS). These issues were in octet string parsing and were found through fuzzing
and code inspection. If these issues were triggered, they would lead to a potentially
exploitable crash. These issues were fixed in NSS version 3.19.2.1 and 3.19.4, shipped in
Firefox and Firefox ESR, respectively, as well as NSS 3.20.1.Google security engineer Ryan Sleevi reported an integer overflow in
the Netscape Portable Runtime (NSPR) due to a lack of checks during memory allocation.
This leads to a potentially exploitable crash. This issue is fixed in NSPR 4.10.10. The NSPR library is a required component of NSS.

Mozilla has updated the version of Network Security
Services (NSS) library used in Mozilla projects to NSS 3.15.3 with the
exception of ESR17-based releases, which have been updated to NSS 3.14.5. This
addresses several moderate to critical rated networking security issues.Google developer Andrew Tinits reported a potentially
exploitable buffer overflow that was fixed in both NSS 3.15.3 and NSS
3.14.5.