CVE-2017-7502

Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.

Score

CVSS 3.0 7.5 High

Status

Modified - secalert@redhat.com

Published

2017-05-30

Last modified

2024-08-05

Weaknesses

CWE-476

Affected products

• Network Security Services (Mozilla)
• Nss (Nss Project)

References

• http://www.debian.org/security/2017/dsa-3872
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.securityfocus.com/bid/98744
• http://www.securitytracker.com/id/1038579
• https://access.redhat.com/errata/RHSA-2017:1364
• https://access.redhat.com/errata/RHSA-2017:1365
• https://access.redhat.com/errata/RHSA-2017:1567
• https://access.redhat.com/errata/RHSA-2017:1712
• https://hg.mozilla.org/projects/nss/rev/55ea60effd0d