Login Request a demo
High severity · published May 30, 2017
CVE-2017-7502
Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker
7.5
CVSS
4.3%
EPSS
No
On KEV
Description
Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Network Security Services · Mozilla
3.24.0; 3.25.0; 3.25.1; 3.26.0; 3.26.2; 3.27.0; +12 more · source: NVD
Affected product
NS
Network Security Services
Mozilla
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7502
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7502
www.debian.org
http://www.debian.org/security/2017/dsa-3872
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Third Party Advisory
http://www.securityfocus.com/bid/98744
www.securitytracker.com
http://www.securitytracker.com/id/1038579
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:1364
access.redhat.com
https://access.redhat.com/errata/RHSA-2017:1365
More from Network Security Services
9.8
CVE-2019-17006
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks
9.8
CVE-2017-5461
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a…
9.8
CVE-2015-7182
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR…
8.8
CVE-2016-2834
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and…
8.8
CVE-2016-1979
Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before…