CVE-2016-5285

HIGH

Mozilla Nss < 3.26 - NULL Pointer Dereference

Title source: rule

Description

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

References (9)

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2016-2779.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/94349

[Vendor Advisory] http://www.ubuntu.com/usn/USN-3163-1

[Various Sources] https://bto.bluecoat.com/security-advisory/sa137

[Issue Tracking] https://bugzilla.mozilla.org/show_bug.cgi?id=1306103

[Third Party Advisory] https://security.gentoo.org/glsa/201701-46

Scores

CVSS v3 7.5

EPSS 0.0158

EPSS Percentile 81.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-476

Status published

Affected Products (50)

mozilla/nss < 3.26

debian/debian_linux

redhat/enterprise_linux

suse/linux_enterprise_server

avaya/aura_application_enablement_services < 6.3.3

avaya/aura_application_enablement_services

avaya/aura_application_server_5300

... and 35 more

Timeline

Published Nov 15, 2019

Tracked Since Feb 18, 2026