CVE-2016-5285

Published: 16 November 2016

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
nss
Launchpad, Ubuntu, Debian 		Upstream
Released (3.25)
Ubuntu 16.04 LTS (Xenial Xerus)
Released (2:3.26.2-0ubuntu0.16.04.2)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2:3.26.2-0ubuntu0.14.04.3)
Patches:
Upstream: https://hg.mozilla.org/projects/nss/rev/45c047d18ac4

Notes

AuthorNote
mdeslaur 
per upstream bug, this was fixed in 3.25, but patch for 3.21
fixes it differently.

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM

Further reading