CVE-2017-7502: Null Pointer Dereference
Last updated 24 July 2024
Other sources
Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.
— Launchpad
Null pointer dereference vulnerability in NSS was found when server receives empty SSLv2 messages. This issue was introduced with the recent removal of SSLv2 protocol from upstream code in 3.24.0 and introduction of dedicated parser able to handle just sslv2-style hello messages.
Upstream patch:
https://hg.mozilla.org/projects/nss/rev/55ea60effd0d
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7502?
CVE-2017-7502 has been classified as a denial of service vulnerability.
How do I fix CVE-2017-7502?
To fix CVE-2017-7502, update to the latest patched version of the NSS software.
Which versions of NSS are affected by CVE-2017-7502?
CVE-2017-7502 affects NSS versions starting from 3.24.0 up to 3.30.1.
What kind of attack can exploit CVE-2017-7502?
CVE-2017-7502 can be exploited by an attacker sending empty SSLv2 messages to cause a denial of service.
Can CVE-2017-7502 be mitigated without updating?
There are no effective mitigations for CVE-2017-7502 other than upgrading to a secure version of NSS.