CVE-2017-7502

Public PoC / Exploit (1)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.

Weaknesses (CWE)

CWE-476CWE-476

Affected Products (18)

mozilla · network_security_servicesvulnerable

mozilla · network_security_services

References (18)

http://www.debian.org/security/2017/dsa-3872

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.securityfocus.com/bid/98744

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038579

https://access.redhat.com/errata/RHSA-2017:1364

https://access.redhat.com/errata/RHSA-2017:1365

https://access.redhat.com/errata/RHSA-2017:1567

https://access.redhat.com/errata/RHSA-2017:1712

https://hg.mozilla.org/projects/nss/rev/55ea60effd0d

Patch

http://www.debian.org/security/2017/dsa-3872