PT-2017-17775 · Mozilla+4 · Network Security Services+4

Published 2017-05-30 · Updated 2023-02-12 · CVE-2017-7502

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Network Security Services (NSS) versions 3.24.0 and later

Description A null pointer dereference issue was discovered in NSS when the server receives empty SSLv2 messages, potentially leading to a denial of service by a remote attacker.

Recommendations For NSS versions 3.24.0 and later, consider disabling SSLv2 support as a temporary workaround until a patch is available.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2017-1885

CESA-2017_1364

CESA-2017_1365

CVE-2017-7502

DLA-971-1

DSA-3872-1

MGASA-2017-0160

RHSA-2017:1364

RHSA-2017:1365

RHSA-2017_1364

RHSA-2017_1365

USN-3336-1

USN-3372-1

Affected Products

Alt Linux

Centos

Network Security Services

Red Hat

Ubuntu

References · 25

• https://cve.org/CVERecord?id=CVE-2017-7502 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-7502 · Security Note
• https://ubuntu.com/security/notices/USN-3372-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3872-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3872 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1567 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7502 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7502 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1364 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3336-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0160.html · Security Note
• https://access.redhat.com/errata/RHSA-2017:1712 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1365 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0160 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3336-1 · Vendor Advisory