REDHAT-BUG-1446631: Null Pointer Dereference
Null pointer dereference vulnerability in NSS was found when server receives empty SSLv2 messages. This issue was introduced with the recent removal of SSLv2 protocol from upstream code in 3.24.0 and introduction of dedicated parser able to handle just sslv2-style hello messages.
Upstream patch:
https://hg.mozilla.org/projects/nss/rev/55ea60effd0d
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1446631?
The severity of REDHAT-BUG-1446631 is classified as moderate due to the potential for a denial of service caused by a null pointer dereference.
How do I fix REDHAT-BUG-1446631?
To fix REDHAT-BUG-1446631, update Mozilla Network Security Services to a version higher than 3.24.0 that includes the upstream patch.
What software is affected by REDHAT-BUG-1446631?
REDHAT-BUG-1446631 affects Mozilla Network Security Services version 3.24.0 and below.
What is the cause of REDHAT-BUG-1446631?
REDHAT-BUG-1446631 is caused by a null pointer dereference when the server receives empty SSLv2 messages after recent code changes.
What type of vulnerability is REDHAT-BUG-1446631?
REDHAT-BUG-1446631 is categorized as a null pointer dereference vulnerability.