CVE Feed

    Dashboard / CVE / CVE-2016-5285

    CVE-2016-5285

    A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

    Published:Nov 16, 2016
    Last Modified:Nov 21, 2024
    EPS:Nov 15, 2019
    EPSS Score:0.00646
    CVSS Score:7.5

    Affected Products

    Vendor
    Avaya
    Product
    Aura Application Enablement Services
    Vendor
    Avaya
    Product
    Aura Application Server 5300
    Vendor
    Avaya
    Product
    Aura Communication Manager
    Vendor
    Avaya
    Product
    Aura Communication Manager Messagint
    Vendor
    Avaya
    Product
    Aura Conferencing
    Vendor
    Avaya
    Product
    Aura Experience Portal
    Vendor
    Avaya
    Product
    Aura Messaging
    Vendor
    Avaya
    Product
    Aura Session Manager
    Vendor
    Avaya
    Product
    Aura System Manager
    Vendor
    Avaya
    Product
    Aura System Platform
    Vendor
    Avaya
    Product
    Aura System Platform Firmware
    Vendor
    Avaya
    Product
    Aura Utility Services
    Vendor
    Avaya
    Product
    Breeze Platform
    Vendor
    Avaya
    Product
    Call Management System
    Vendor
    Avaya
    Product
    Cs1000e
    Vendor
    Avaya
    Product
    Cs1000e\/cs1000m Signaling Server
    Vendor
    Avaya
    Product
    Cs1000e\/cs1000m Signaling Server Firmware
    Vendor
    Avaya
    Product
    Cs1000e Firmware
    Vendor
    Avaya
    Product
    Cs1000m
    Vendor
    Avaya
    Product
    Cs1000m Firmware
    Vendor
    Avaya
    Product
    Ip Office
    Vendor
    Avaya
    Product
    Iq
    Vendor
    Avaya
    Product
    Meeting Exchange
    Vendor
    Avaya
    Product
    Message Networking
    Vendor
    Avaya
    Product
    One-x Client Enablement Services
    Vendor
    Avaya
    Product
    Proactive Contact
    Vendor
    Avaya
    Product
    Session Border Controller For Enterprise
    Vendor
    Avaya
    Product
    Session Border Controller For Enterprise Firmware
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Mozilla
    Product
    Nss
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Suse
    Product
    Linux Enterprise Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-476 NULL Pointer Dereference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
    http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
    http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html
    http://rhn.redhat.com/errata/RHSA-2016-2779.html
    http://www.securityfocus.com/bid/94349
    http://www.ubuntu.com/usn/USN-3163-1
    https://bto.bluecoat.com/security-advisory/sa137
    https://bugzilla.mozilla.org/show_bug.cgi?id=1306103
    https://security.gentoo.org/glsa/201701-46
    http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
    http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
    http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html
    http://rhn.redhat.com/errata/RHSA-2016-2779.html
    http://www.securityfocus.com/bid/94349
    http://www.ubuntu.com/usn/USN-3163-1
    https://bto.bluecoat.com/security-advisory/sa137
    https://bugzilla.mozilla.org/show_bug.cgi?id=1306103
    https://security.gentoo.org/glsa/201701-46

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High