7.5

CVE-2016-5285

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Nss Version < 3.26
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Redhat ≫ Enterprise Linux Version 5.0
Redhat ≫ Enterprise Linux Version 6.0
Redhat ≫ Enterprise Linux Version 7.0
Suse ≫ Linux Enterprise Server Version 11 Update sp2 SwEdition ltss
Avaya ≫ Aura Application Enablement Services Version >= 6.1 <= 6.3.3
Avaya ≫ Aura Application Server 5300 Version 3.0 Update -
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp1
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp10
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp10.1
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp11
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp11.1
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp12
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp12.1
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp12.2
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp12.3
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp12.5
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp3
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp5
Avaya ≫ Aura Application Server 5300 Version 3.0 Update sp7
Avaya ≫ Aura Communication Manager Version >= 6.0 <= 6.3.117.0
Avaya ≫ Aura Communication Manager Version 7.0 Update -
Avaya ≫ Aura Communication Manager Version 7.0 Update sp
Avaya ≫ Aura Communication Manager Version 7.0 Update sp3
Avaya ≫ Aura Communication Manager Messagint Version 7.0 Update -
Avaya ≫ Aura Communication Manager Messagint Version 7.0 Update sp1
Avaya ≫ Breeze Platform Version >= 3.0 <= 3.2
Avaya ≫ Call Management System Version >= 18.0.0.1 <= 18.0.0.2
Avaya ≫ Call Management System Version 17.0 Update -
Avaya ≫ Call Management System Version 17.0 Update r3
Avaya ≫ Call Management System Version 17.0 Update r4
Avaya ≫ Call Management System Version 17.0 Update r5
Avaya ≫ Call Management System Version 17.0 Update r6
Avaya ≫ Iq Version 5.2.x
Avaya ≫ Cs1000e Firmware Version >= 7.0 <= 7.6
   Avaya ≫ Cs1000e Version -
Avaya ≫ Cs1000m Firmware Version >= 7.0 <= 7.6
   Avaya ≫ Cs1000m Version -
Avaya ≫ Aura Conferencing Version 7.0
Avaya ≫ Aura Conferencing Version 7.2
Avaya ≫ Aura Conferencing Version 8.0 Update -
Avaya ≫ Aura Conferencing Version 8.0 Update sp2
Avaya ≫ Aura Conferencing Version 8.0 Update sp4
Avaya ≫ Aura Conferencing Version 8.0 Update sp5
Avaya ≫ Aura Conferencing Version 8.0 Update sp7
Avaya ≫ Aura Conferencing Version 8.0 Update sp8
Avaya ≫ Aura Conferencing Version 8.0 Update sp9
Avaya ≫ Aura Experience Portal Version >= 6.0 <= 7.1
Avaya ≫ Ip Office Version 8.1
Avaya ≫ Ip Office Version 9.1 Update -
Avaya ≫ Ip Office Version 9.1 Update sp1
Avaya ≫ Ip Office Version 9.1 Update sp10
Avaya ≫ Ip Office Version 9.1 Update sp11
Avaya ≫ Ip Office Version 9.1 Update sp12
Avaya ≫ Ip Office Version 9.1 Update sp3
Avaya ≫ Ip Office Version 9.1 Update sp4
Avaya ≫ Ip Office Version 9.1 Update sp5
Avaya ≫ Ip Office Version 9.1 Update sp6
Avaya ≫ Ip Office Version 9.1 Update sp7
Avaya ≫ Ip Office Version 9.1 Update sp8
Avaya ≫ Ip Office Version 9.1 Update sp9
Avaya ≫ Ip Office Version 10.0 Update -
Avaya ≫ Ip Office Version 10.0 Update sp1
Avaya ≫ Ip Office Version 10.0 Update sp2
Avaya ≫ Ip Office Version 10.0 Update sp3
Avaya ≫ Ip Office Version 10.0 Update sp4
Avaya ≫ Ip Office Version 10.0 Update sp5
Avaya ≫ Ip Office Version 10.0 Update sp6
Avaya ≫ Ip Office Version 10.0 Update sp7
Avaya ≫ Aura Messaging Version 6.3
Avaya ≫ Aura Messaging Version 6.3.3 Update -
Avaya ≫ Aura Messaging Version 6.3.3 Update sp4
Avaya ≫ Aura Messaging Version 6.3.3 Update sp5
Avaya ≫ Aura Messaging Version 6.3.3 Update sp6
Avaya ≫ Aura Session Manager Version >= 6.3 <= 6.3.18
Avaya ≫ Aura Session Manager Version 7.0 Update -
Avaya ≫ Aura Session Manager Version 7.0 Update sp1
Avaya ≫ Aura Session Manager Version 7.0 Update sp2
Avaya ≫ Aura Session Manager Version 7.0.1 Update -
Avaya ≫ Aura Session Manager Version 7.0.1 Update sp1
Avaya ≫ Aura Session Manager Version 7.0.1 Update sp2
Avaya ≫ Aura System Manager Version >= 6.3 <= 6.3.18
Avaya ≫ Aura System Manager Version >= 7.0 <= 7.0.1.3
Avaya ≫ Aura Utility Services Version >= 6.3 <= 6.3.14
Avaya ≫ Aura Utility Services Version >= 7.0 <= 7.0.1.2
Avaya ≫ Meeting Exchange Version 6.2 Update -
Avaya ≫ Meeting Exchange Version 6.2 Update sp3
Avaya ≫ Message Networking Version >= 5.2 <= 6.3
Avaya ≫ One-x Client Enablement Services Version 6.2 Update -
Avaya ≫ One-x Client Enablement Services Version 6.2 Update sp1
Avaya ≫ One-x Client Enablement Services Version 6.2 Update sp2
Avaya ≫ One-x Client Enablement Services Version 6.2 Update sp5
Avaya ≫ Proactive Contact Version >= 5.0 <= 5.1.2
Avaya ≫ Aura System Platform Firmware Version >= 6.3 <= 6.4.0
   Avaya ≫ Aura System Platform Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.28% 0.809
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://security.gentoo.org/glsa/201701-46
http://rhn.redhat.com/errata/RHSA-2016-2779.html
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/94349
http://www.ubuntu.com/usn/USN-3163-1
https://bto.bluecoat.com/security-advisory/sa137
https://bugzilla.mozilla.org/show_bug.cgi?id=1306103