CVE-2016-5285
High
Description
A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Mozilla Nss
PublishedNov 15, 2019
First seenNov 15, 2019
How to fix
Update
- mozilla nss3.26 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla nss | v < 3.26 | 3.26 |
| debian debian_linux | 8.0, 9.0, 10.0 | — |
| redhat enterprise_linux | 5.0, 6.0, 7.0 | — |
| suse linux_enterprise_server | 11 | — |
| avaya aura_application_enablement_services | 6.1 ≤ v ≤ 6.3.3, 7.0 | — |
| avaya aura_application_server_5300 | 3.0 | — |
| avaya aura_communication_manager | 6.0 ≤ v ≤ 6.3.117.0, 7.0 | — |
| avaya aura_communication_manager_messagint | 7.0 | — |
| avaya breeze_platform | 3.0 ≤ v ≤ 3.2 | — |
| avaya call_management_system | 18.0.0.1 ≤ v ≤ 18.0.0.2, 17.0 | — |
| avaya iq | 5.2.x | — |
| avaya cs1000e_firmware | 7.0 ≤ v ≤ 7.6 | — |
| avaya cs1000m_firmware | 7.0 ≤ v ≤ 7.6 | — |
| avaya cs1000e\/cs1000m_signaling_server_firmware | 7.0 ≤ v ≤ 7.6 | — |
| avaya aura_conferencing | 7.0, 7.2, 8.0 | — |
| avaya aura_experience_portal | 6.0 ≤ v ≤ 7.1 | — |
| avaya ip_office | 8.1, 9.1, 10.0 | — |
| avaya aura_messaging | 6.3, 6.3.3 | — |
| avaya aura_session_manager | 6.3 ≤ v ≤ 6.3.18, 7.0, 7.0.1 | — |
| avaya aura_system_manager | 6.3 ≤ v ≤ 6.3.18, 7.0 ≤ v ≤ 7.0.1.3 | — |
| avaya aura_utility_services | 6.3 ≤ v ≤ 6.3.14, 7.0 ≤ v ≤ 7.0.1.2 | — |
| avaya meeting_exchange | 6.2 | — |
| avaya message_networking | 5.2 ≤ v ≤ 6.3 | — |
| avaya one-x_client_enablement_services | 6.2 | — |
| avaya proactive_contact | 5.0 ≤ v ≤ 5.1.2 | — |
| avaya session_border_controller_for_enterprise_firmware | 6.2 ≤ v ≤ 6.3, 7.0 ≤ v ≤ 7.1 | — |
| avaya aura_system_platform_firmware | 6.3 ≤ v ≤ 6.4.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.