1. Home
  2. CVE Database
  3. CVE-2016-5285
HIGH · 7.5

CVE-2016-5285

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote ma...

Vulnerability Description

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
MozillaNss< 3.26
DebianDebian Linux8.0
RedhatEnterprise Linux5.0
SuseLinux Enterprise Server11
AvayaAura Application Enablement Services>= 6.1, <= 6.3.3
AvayaAura Application Server 53003.0
AvayaAura Communication Manager>= 6.0, <= 6.3.117.0
AvayaAura Communication Manager Messagint7.0
AvayaBreeze Platform>= 3.0, <= 3.2
AvayaCall Management System>= 18.0.0.1, <= 18.0.0.2
AvayaIq5.2.x
AvayaCs1000E Firmware>= 7.0, <= 7.6
AvayaCs1000E-
AvayaCs1000M Firmware>= 7.0, <= 7.6
AvayaCs1000M-
AvayaCs1000E\/Cs1000M Signaling Server Firmware>= 7.0, <= 7.6
AvayaCs1000E\/Cs1000M Signaling Server-
AvayaAura Conferencing7.0
AvayaAura Experience Portal>= 6.0, <= 7.1
AvayaIp Office8.1

Related Weaknesses (CWE)

CWE-476

References

FAQ

What is CVE-2016-5285?

CVE-2016-5285 is a vulnerability with a CVSS score of 7.5 (HIGH). A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote ma...

How severe is CVE-2016-5285?

CVE-2016-5285 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-5285?

Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Nss, Debian Debian Linux, Redhat Enterprise Linux, Suse Linux Enterprise Server, Avaya Aura Application Enablement Services.