CVE-2016-5285

Published: 16 November 2016

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
nss Launchpad, Ubuntu, Debian	Upstream	Released (3.25)





	Ubuntu 16.04 ESM (Xenial Xerus)	Released (2:3.26.2-0ubuntu0.16.04.2)
	Ubuntu 14.04 ESM (Trusty Tahr)	Released (2:3.26.2-0ubuntu0.14.04.3)
	Patches: Upstream: https://hg.mozilla.org/projects/nss/rev/45c047d18ac4

Notes

Author	Note
mdeslaur	per upstream bug, this was fixed in 3.25, but patch for 3.21 fixes it differently.

References

Bugs

https://bugzilla.mozilla.org/show_bug.cgi?id=1306103

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM

Further reading