PT-2018-2701 · Mozilla+5 · Network Security Services+5

Published 2018-07-05 · Updated 2021-02-18 · CVE-2018-18508

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Network Security Services (NSS) versions prior to 3.36.7 Network Security Services (NSS) versions prior to 3.41.1

Description A malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service. The vulnerability is related to errors in pointer dereferencing in the Certificate Management Server (CMS) component of the NSS library. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 3.36.7, update to version 3.36.7 or later. For versions prior to 3.41.1, update to version 3.41.1 or later.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-1984

BDU:2019-01410

CESA-2019_1951

CVE-2018-18508

DLA-1704-1

DLA-2388-1

OPENSUSE-SU-2020:0008-1

OPENSUSE-SU-2020_0008-1

RHSA-2019:1951

RHSA-2019_1951

SUSE-SU-2019:3395-1

SUSE-SU-2019_3395-1

USN-3898-1

USN-3898-2

Affected Products

Alt Linux

Centos

Network Security Services

Red Hat

Suse

Ubuntu

References · 36

• https://ubuntu.com/security/notices/USN-3898-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3898-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18508 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18508 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18508 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18508 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18508 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-18508 · Security Note
• https://osv.dev/vulnerability/DLA-1704-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01410 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:3395-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2388-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-18508 · Vendor Advisory