CVE-2019-17007: Null Pointer Dereference

Published Apr 29, 2019
·
Updated

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.

Other sources

Main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage() mishandles old Netscape Certificate Sequences, with possible crash as NULL pointer is dereferenced, leading to DoS.

External References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1798

Red Hat

Mozilla Network Security Services (NSS), as used in Mozilla Firefox is vulnerable to a denial of service, caused by a NULL pointer dereference when handling Netscape Certificate Sequences in CERTDecodeCertPackage(). A remote attacker could exploit this vulnerability to cause the library to crash.

IBM

Affected Software

27 affected componentsFixes available
redhat/nss<3.44
3.44
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP4
Siemens RUGGEDCOM ROX MX5000<2.14.0
2.14.0
Siemens RUGGEDCOM ROX RX1400<2.14.0
2.14.0
Siemens RUGGEDCOM ROX RX1500<2.14.0
2.14.0
Siemens RUGGEDCOM ROX RX1501<2.14.0
2.14.0
Siemens RUGGEDCOM ROX RX1510<2.14.0
2.14.0
Siemens RUGGEDCOM ROX RX1511<2.14.0
2.14.0
Siemens RUGGEDCOM ROX RX500<2.14.0
2.14.0
Mozilla Network Security Services<3.44
Siemens Ruggedcom Rox Mx5000 Firmware<2.14.0
Siemens RUGGEDCOM ROX MX5000
Siemens Ruggedcom Rox Rx1400 Firmware<2.14.0
Siemens RUGGEDCOM ROX RX1400
Siemens Ruggedcom Rox Rx1500 Firmware<2.14.0
Siemens RUGGEDCOM ROX RX1500
Siemens Ruggedcom Rox Rx1501 Firmware<2.14.0
Siemens RUGGEDCOM ROX RX1501
Siemens Ruggedcom Rox Rx1510 Firmware<2.14.0
Siemens RUGGEDCOM ROX RX1510
Siemens Ruggedcom Rox Rx1511 Firmware<2.14.0
Siemens RUGGEDCOM ROX RX1511
Siemens Ruggedcom Rox Rx1512 Firmware<2.14.0
Siemens RUGGEDCOM ROX RX1512
Siemens Ruggedcom Rox Rx5000 Firmware<2.14.0
Siemens Ruggedcom Rox Rx5000

Event History

Apr 29, 2019
Data Sourced
via Red Hat·08:42 AM
DescriptionSeverityAffected Software
Oct 22, 2020
CVE Published
via MITRE·08:28 PM
Data Sourced
via MITRE·08:28 PM
DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2019-17007?

CVE-2019-17007 is a vulnerability in Network Security Services (NSS) before version 3.44.

2

How does CVE-2019-17007 affect systems?

CVE-2019-17007 can cause NSS to crash, resulting in a denial of service.

3

What is the severity of CVE-2019-17007?

The severity of CVE-2019-17007 is high, with a CVSS score of 7.5.

4

How do I fix CVE-2019-17007?

To fix CVE-2019-17007, update Network Security Services (NSS) to version 3.44 or later.

5

Where can I find more information about CVE-2019-17007?

You can find more information about CVE-2019-17007 on the following references: 1. [Chromium Project Zero](https://bugs.chromium.org/p/project-zero/issues/detail?id=1798) 2. [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1703987) 3. [Mozilla NSS Repository](https://hg.mozilla.org/projects/nss/rev/1473dd7efe2ce4f8722a33ebb03a3425e09887de)

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203