National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2016-5285 Detail

Current Description

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

Source:  MITRE
View Analysis Description

Severity



CVSS 3.x Severity and Metrics:

NIST CVSS score
NIST: NVD
Base Score: 7.5 HIGH
Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html Mailing List Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2779.html
http://www.securityfocus.com/bid/94349
http://www.ubuntu.com/usn/USN-3163-1
https://bto.bluecoat.com/security-advisory/sa137
https://bugzilla.mozilla.org/show_bug.cgi?id=1306103
https://security.gentoo.org/glsa/201701-46

Weakness Enumeration

CWE-ID CWE Name Source
CWE-476 NULL Pointer Dereference NIST  

Known Affected Software Configurations Switch to CPE 2.3

Configuration 1 ( hide )
 cpe:/a:mozilla:nss
     Show Matching CPE(s)
Up to (excluding)
3.26

Configuration 2 ( hide )
 cpe:/o:debian:debian_linux:8.0
     Show Matching CPE(s)
 cpe:/o:debian:debian_linux:9.0
     Show Matching CPE(s)
 cpe:/o:debian:debian_linux:10.0
     Show Matching CPE(s)

Configuration 3 ( hide )
 cpe:/o:redhat:enterprise_linux:5.0
     Show Matching CPE(s)
 cpe:/o:redhat:enterprise_linux:6.0
     Show Matching CPE(s)
 cpe:/o:redhat:enterprise_linux:7.0
     Show Matching CPE(s)

Configuration 4 ( hide )
 cpe:/o:suse:linux_enterprise_server:11:sp2:~~ltss~~~
     Show Matching CPE(s)

Configuration 5 ( hide )
 cpe:/a:avaya:aura_application_enablement_services
     Show Matching CPE(s)
From (including)
6.1
Up to (including)
6.3.3
 cpe:/a:avaya:aura_application_enablement_services:7.0
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:-
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp1
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp10
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp10.1
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp11
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp11.1
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp12
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp12.1
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp12.2
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp12.3
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp12.5
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp3
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp5
     Show Matching CPE(s)
 cpe:/a:avaya:aura_application_server_5300:3.0:sp7
     Show Matching CPE(s)
 cpe:/a:avaya:aura_communication_manager
     Show Matching CPE(s)
From (including)
6.0
Up to (including)
6.3.117.0
 cpe:/a:avaya:aura_communication_manager:7.0:-
     Show Matching CPE(s)
 cpe:/a:avaya:aura_communication_manager:7.0:sp
     Show Matching CPE(s)
 cpe:/a:avaya:aura_communication_manager:7.0:sp3
     Show Matching CPE(s)
 cpe:/a:avaya:aura_communication_manager_messagint:7.0:-
     Show Matching CPE(s)
 cpe:/a:avaya:aura_communication_manager_messagint:7.0:sp1
     Show Matching CPE(s)
 cpe:/a:avaya:breeze_platform
     Show Matching CPE(s)
From (including)
3.0
Up to (including)
3.2
 cpe:/a:avaya:call_management_system:17.0:-
     Show Matching CPE(s)
 cpe:/a:avaya:call_management_system:17.0:r3
     Show Matching CPE(s)
 cpe:/a:avaya:call_management_system:17.0:r4
     Show Matching CPE(s)
 cpe:/a:avaya:call_management_system:17.0:r5
     Show Matching CPE(s)
 cpe:/a:avaya:call_management_system:17.0:r6
     Show Matching CPE(s)
 cpe:/a:avaya:call_management_system
     Show Matching CPE(s)
From (including)
18.0.0.1
Up to (including)
18.0.0.2
 cpe:/a:avaya:iq:5.2.x
     Show Matching CPE(s)

Configuration 6 ( hide )
 cpe:/o:avaya:cs1000e_firmware
     Show Matching CPE(s)
From (including)
7.0
Up to (including)
7.6
Running on/with
 cpe:/h:avaya:cs1000e:-
     Show Matching CPE(s)

Configuration 7 ( hide )
 cpe:/o:avaya:cs1000m_firmware
     Show Matching CPE(s)
From (including)
7.0
Up to (including)
7.6
Running on/with
 cpe:/h:avaya:cs1000m:-
     Show Matching CPE(s)

Configuration 8 ( hide )
 cpe:/o:avaya:cs1000e%2fcs1000m_signaling_server_firmware
     Show Matching CPE(s)
From (including)
7.0
Up to (including)
7.6
Running on/with
 cpe:/h:avaya:cs1000e%2fcs1000m_signaling_server:-
     Show Matching CPE(s)

Configuration 9 ( hide )
 cpe:/a:avaya:aura_conferencing:7.0
     Show Matching CPE(s)
 cpe:/a:avaya:aura_conferencing:7.2
     Show Matching CPE(s)
 cpe:/a:avaya:aura_conferencing:8.0:-
     Show Matching CPE(s)
 cpe:/a:avaya:aura_conferencing:8.0:sp2
     Show Matching CPE(s)
 cpe:/a:avaya:aura_conferencing:8.0:sp4
     Show Matching CPE(s)
 cpe:/a:avaya:aura_conferencing:8.0:sp5
     Show Matching CPE(s)
 cpe:/a:avaya:aura_conferencing:8.0:sp7
     Show Matching CPE(s)
 cpe:/a:avaya:aura_conferencing:8.0:sp8
     Show Matching CPE(s)
 cpe:/a:avaya:aura_conferencing:8.0:sp9
     Show Matching CPE(s)
 cpe:/a:avaya:aura_experience_portal
     Show Matching CPE(s)
From (including)
6.0
Up to (including)
7.1

Configuration 10 ( hide )
 cpe:/a:avaya:ip_office:8.1
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:-
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp1
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp10
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp11
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp12
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp3
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp4
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp5
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp6
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp7
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp8
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:9.1:sp9
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:10.0:-
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:10.0:sp1
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:10.0:sp2
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:10.0:sp3
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:10.0:sp4
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:10.0:sp5
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:10.0:sp6
     Show Matching CPE(s)
 cpe:/a:avaya:ip_office:10.0:sp7
     Show Matching CPE(s)

Configuration 11 ( hide )
 cpe:/a:avaya:aura_messaging:6.3
     Show Matching CPE(s)
 cpe:/a:avaya:aura_messaging:6.3.3:-
     Show Matching CPE(s)
 cpe:/a:avaya:aura_messaging:6.3.3:sp4
     Show Matching CPE(s)
 cpe:/a:avaya:aura_messaging:6.3.3:sp5
     Show Matching CPE(s)
 cpe:/a:avaya:aura_messaging:6.3.3:sp6
     Show Matching CPE(s)
 cpe:/a:avaya:aura_session_manager
     Show Matching CPE(s)
From (including)
6.3
Up to (including)
6.3.18
 cpe:/a:avaya:aura_session_manager:7.0:-
     Show Matching CPE(s)
 cpe:/a:avaya:aura_session_manager:7.0:sp1
     Show Matching CPE(s)
 cpe:/a:avaya:aura_session_manager:7.0:sp2
     Show Matching CPE(s)
 cpe:/a:avaya:aura_session_manager:7.0.1:-
     Show Matching CPE(s)
 cpe:/a:avaya:aura_session_manager:7.0.1:sp1
     Show Matching CPE(s)
 cpe:/a:avaya:aura_session_manager:7.0.1:sp2
     Show Matching CPE(s)
 cpe:/a:avaya:aura_system_manager
     Show Matching CPE(s)
From (including)
6.3
Up to (including)
6.3.18
 cpe:/a:avaya:aura_system_manager
     Show Matching CPE(s)
From (including)
7.0
Up to (including)
7.0.1.3
 cpe:/a:avaya:aura_utility_services
     Show Matching CPE(s)
From (including)
6.3
Up to (including)
6.3.14
 cpe:/a:avaya:aura_utility_services
     Show Matching CPE(s)
From (including)
7.0
Up to (including)
7.0.1.2
 cpe:/a:avaya:meeting_exchange:6.2:-
     Show Matching CPE(s)
 cpe:/a:avaya:meeting_exchange:6.2:sp3
     Show Matching CPE(s)
 cpe:/a:avaya:message_networking
     Show Matching CPE(s)
From (including)
5.2
Up to (including)
6.3
 cpe:/a:avaya:one-x_client_enablement_services:6.2:-
     Show Matching CPE(s)
 cpe:/a:avaya:one-x_client_enablement_services:6.2:sp1
     Show Matching CPE(s)
 cpe:/a:avaya:one-x_client_enablement_services:6.2:sp2
     Show Matching CPE(s)
 cpe:/a:avaya:one-x_client_enablement_services:6.2:sp5
     Show Matching CPE(s)
 cpe:/a:avaya:proactive_contact
     Show Matching CPE(s)
From (including)
5.0
Up to (including)
5.1.2

Configuration 12 ( hide )
 cpe:/o:avaya:session_border_controller_for_enterprise_firmware
     Show Matching CPE(s)
From (including)
6.2
Up to (including)
6.3
 cpe:/o:avaya:session_border_controller_for_enterprise_firmware
     Show Matching CPE(s)
From (including)
7.0
Up to (including)
7.1
Running on/with
 cpe:/h:avaya:session_border_controller_for_enterprise:-
     Show Matching CPE(s)

Configuration 13 ( hide )
 cpe:/o:avaya:aura_system_platform_firmware
     Show Matching CPE(s)
From (including)
6.3
Up to (including)
6.4.0
Running on/with
 cpe:/h:avaya:aura_system_platform:-
     Show Matching CPE(s)


Change History

2 change records found - show changes

Quick Info

CVE Dictionary Entry:
CVE-2016-5285
NVD Published Date:
11/15/2019
NVD Last Modified:
01/09/2020