PT-2018-2701 · Mozilla+5 · Network Security Services+5

Publicado 2018-07-05 · Atualizado 2021-02-18 · CVE-2018-18508

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Network Security Services (NSS) versions prior to 3.36.7 Network Security Services (NSS) versions prior to 3.41.1

Description A malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service. The vulnerability is related to errors in pointer dereferencing in the Certificate Management Server (CMS) component of the NSS library. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 3.36.7, update to version 3.36.7 or later. For versions prior to 3.41.1, update to version 3.41.1 or later.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2018-1984

BDU:2019-01410

CESA-2019_1951

CVE-2018-18508

DLA-1704-1

DLA-2388-1

OPENSUSE-SU-2020:0008-1

OPENSUSE-SU-2020_0008-1

RHSA-2019:1951

RHSA-2019_1951

SUSE-SU-2019:3395-1

SUSE-SU-2019_3395-1

USN-3898-1

USN-3898-2

Produtos afetados

Alt Linux

Centos

Network Security Services

Red Hat

Suse

Ubuntu

Referências · 36

• https://ubuntu.com/security/notices/USN-3898-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3898-1 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html · Nota
• https://ubuntu.com/security/CVE-2018-18508 · Aviso do Fabricante
• https://t.me/cibsecurity/15541 · Publicação no Telegram
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/AN4USN47JRBDAYTJ7ARVSFYOKEKTGTFV · Nota
• https://osv.dev/vulnerability/CVE-2018-18508 · Aviso do Fabricante
• https://bugzilla.suse.com/1159819 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18508 · Aviso do Fabricante
• https://t.me/cvenotify/9853 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18508 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-11745 · Nota
• https://cve.org/CVERecord?id=CVE-2018-18508 · Nota de Segurança