REDHAT-BUG-1446631: Null Pointer Dereference
First published: Fri Apr 28 2017(Updated: )
Null pointer dereference vulnerability in NSS was found when server receives empty SSLv2 messages. This issue was introduced with the recent removal of SSLv2 protocol from upstream code in 3.24.0 and introduction of dedicated parser able to handle just sslv2-style hello messages. Upstream patch: <a href="https://hg.mozilla.org/projects/nss/rev/55ea60effd0d">https://hg.mozilla.org/projects/nss/rev/55ea60effd0d</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla NSS ESR | >3.24.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://hg.mozilla.org/projects/nss/rev/55ea60effd0d
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1450763
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1449161
- https://access.redhat.com/errata/RHSA-2017:1365
- https://access.redhat.com/errata/RHSA-2017:1364
- https://access.redhat.com/errata/RHSA-2017:1567
- https://bugzilla.redhat.com/show_bug.cgi?id=1446631
Frequently Asked Questions
What is the severity of REDHAT-BUG-1446631?
The severity of REDHAT-BUG-1446631 is classified as moderate due to the potential for a denial of service caused by a null pointer dereference.
How do I fix REDHAT-BUG-1446631?
To fix REDHAT-BUG-1446631, update Mozilla Network Security Services to a version higher than 3.24.0 that includes the upstream patch.
What software is affected by REDHAT-BUG-1446631?
REDHAT-BUG-1446631 affects Mozilla Network Security Services version 3.24.0 and below.
What is the cause of REDHAT-BUG-1446631?
REDHAT-BUG-1446631 is caused by a null pointer dereference when the server receives empty SSLv2 messages after recent code changes.
What type of vulnerability is REDHAT-BUG-1446631?
REDHAT-BUG-1446631 is categorized as a null pointer dereference vulnerability.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-7502
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/mozilla
- canonical/mozilla nss esr