p PatchFirst

CVE-2017-7502

CVE-2017-7502

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.

CVSS 7.5 · High · EPSS 4.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • nss

    Versions
    • since 3.24.0: Affected

    No fix published

  • nss Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:3.26.2-1.1

    Update to 2:3.26.2-1.1

  • nss Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:3.26.2-1.1

    Update to 2:3.26.2-1.1

  • nss Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:3.26.2-1.1

    Update to 2:3.26.2-1.1

  • nss Ubuntu:14.04:LTS

    Versions
    • 2:3.15.1-1ubuntu1
    • 2:3.15.2-1
    • 2:3.15.3-1
    • 2:3.15.3.1-1
    • 2:3.15.3.1-1.1
    • 2:3.15.3.1-1.1ubuntu1
    • 2:3.15.4-1ubuntu3
    • 2:3.15.4-1ubuntu4
    • 2:3.15.4-1ubuntu5
    • 2:3.15.4-1ubuntu6
    • 2:3.15.4-1ubuntu7
    • 2:3.15.4-1ubuntu7.1
    • 2:3.17-0ubuntu0.14.04.1
    • 2:3.17.1-0ubuntu0.14.04.1
    • 2:3.17.1-0ubuntu0.14.04.2
    • 2:3.17.4-0ubuntu0.14.04.1
    • 2:3.19.2-0ubuntu0.14.04.1
    • 2:3.19.2.1-0ubuntu0.14.04.1
    • 2:3.19.2.1-0ubuntu0.14.04.2
    • 2:3.21-0ubuntu0.14.04.1
    • 2:3.21-0ubuntu0.14.04.2
    • 2:3.23-0ubuntu0.14.04.1
    • 2:3.26.2-0ubuntu0.14.04.3
    • 2:3.28.4-0ubuntu0.14.04.1
    Affected ranges
    • ECOSYSTEM: < 2:3.28.4-0ubuntu0.14.04.2

    Update to 2:3.28.4-0ubuntu0.14.04.2

  • nss Ubuntu:16.04:LTS

    Versions
    • 2:3.19.2-1ubuntu1
    • 2:3.19.2.1-0ubuntu1
    • 2:3.21-1ubuntu2
    • 2:3.21-1ubuntu3
    • 2:3.21-1ubuntu4
    • 2:3.23-0ubuntu0.16.04.1
    • 2:3.26.2-0ubuntu0.16.04.2
    • 2:3.28.4-0ubuntu0.16.04.1
    Affected ranges
    • ECOSYSTEM: < 2:3.28.4-0ubuntu0.16.04.2

    Update to 2:3.28.4-0ubuntu0.16.04.2

Original sources

Check your server →