CVE-2016-5285
A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - security@mozilla.org
- Published
- 2019-11-15
- Last modified
- 2024-08-06
- Weaknesses
- CWE-476
Affected products
- Aura Application Enablement Services (Avaya)
- Aura Application Server 5300 (Avaya)
- Aura Communication Manager (Avaya)
- Aura Communication Manager Messagint (Avaya)
- Aura Conferencing (Avaya)
- Aura Experience Portal (Avaya)
- Aura Messaging (Avaya)
- Aura Session Manager (Avaya)
- Aura System Manager (Avaya)
- Aura System Platform Firmware (Avaya)
- Aura Utility Services (Avaya)
- Breeze Platform (Avaya)
- Call Management System (Avaya)
- Cs1000e/cs1000m Signaling Server Firmware (Avaya)
- Cs1000e Firmware (Avaya)
- Cs1000m Firmware (Avaya)
- Ip Office (Avaya)
- Iq (Avaya)
- Meeting Exchange (Avaya)
- Message Networking (Avaya)
- One-x Client Enablement Services (Avaya)
- Proactive Contact (Avaya)
- Session Border Controller For Enterprise Firmware (Avaya)
- Debian Linux (Debian)
- Network Security Services (Mozilla)
- Nss (Mozilla)
- Enterprise Linux (Redhat)
- Linux Enterprise Server (Suse)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html
- http://rhn.redhat.com/errata/RHSA-2016-2779.html
- http://www.securityfocus.com/bid/94349
- http://www.ubuntu.com/usn/USN-3163-1
- https://bto.bluecoat.com/security-advisory/sa137
- https://bugzilla.mozilla.org/show_bug.cgi?id=1306103
- https://security.gentoo.org/glsa/201701-46
