Every CVE Search/ Get API key

CVE-2018-18508

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can...

6.5 MediumFix available

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.97%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Record
CVE-2018-18508
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Record
CVE-2018-18508
Updated
2026-11-02
EUVDEUVD-2018-10233 No score

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Record
EUVD-2018-10233
Updated
2026-11-03
GitHub AdvisoriesGHSA-45r6-rwfw-29cq No score

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can...

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Record
GHSA-45r6-rwfw-29cq
Weakness
CWE-476
Updated
2026-11-02
OSV 6.5

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Record
CVE-2018-18508
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-18508 6.5

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Record
DEBIAN-CVE-2018-18508
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2019:1951 7.5

Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

Record
RHSA-2019:1951
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-18508 6.5

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.

Record
UBUNTU-CVE-2018-18508
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2020:0008-1 No score

Security update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to NSS 3.47.1:

Security issues fixed:

  • CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
  • CVE-2019-11745: EncryptUpdate should use maxout, not block size (bsc#1158527).
  • CVE-2019-11727: Fixed vulnerability sign CertificateVerify with PKCS#1 v1.5 signatures issue (bsc#1141322).

mozilla-nspr was updated to version 4.23:

  • Whitespace in C files was cleaned up and no longer uses tab characters for indenting.

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0008-1
Updated
2026-11-02
OSVSUSE-SU-2019:3395-1 No score

Security update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to NSS 3.47.1:

Security issues fixed:

  • CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
  • CVE-2019-11745: EncryptUpdate should use maxout, not block size (bsc#1158527).
  • CVE-2019-11727: Fixed vulnerability sign CertificateVerify with PKCS#1 v1.5 signatures issue (bsc#1141322).

mozilla-nspr was updated to version 4.23:

  • Whitespace in C files was cleaned up and no longer uses tab characters for indenting.
Record
SUSE-SU-2019:3395-1
Updated
2026-11-02
OSVUSN-3898-1 No score

nss vulnerability

Hanno Böck and Damian Poddebniak discovered that NSS incorrectly handled certain CMS functions. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service.

Record
USN-3898-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nss
Debian:12
 before 2:3.42.1-1
2:3.42.1-1
nss
Debian:13
 before 2:3.42.1-1
2:3.42.1-1
nss
Debian:14
 before 2:3.42.1-1
2:3.42.1-1
nss
Debian:8
 before 2:3.26-1+debu8u4, plus listed versions
2:3.17.2-1.12:3.17.2-1.1+deb8u12:3.17.2-1.1+deb8u22:3.17.2-1.1+x322:3.17.4-1
Show 14 moreShow less
2:3.18-12:3.19-12:3.19.1-12:3.19.1-22:3.19.2-12:3.19.2-1+x32.12:3.20-12:3.20.1-12:3.21-12:3.21-1.12:3.23-12:3.23-22:3.25-12:3.26-1
2:3.26-1+debu8u4
nss
Debian:9
 before 2:3.26.2-1.1+deb9u2, plus listed versions
2:3.26.2-1.12:3.26.2-1.1+deb9u1
2:3.26.2-1.1+deb9u2
nspr
Red Hat:enterprise_linux:8::appstream
 before 0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
nspr-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
nspr-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
nspr-devel
Red Hat:enterprise_linux:8::appstream
 before 0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
nss
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
Show 26 moreShow less
Affected packages
PackageAffectedFixed
nss-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-freebl
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-freebl-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-softokn-freebl-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-sysinit
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-sysinit-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-tools
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-util
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-util-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
nss-util-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
mozilla-nspr
SUSE:Linux Enterprise Module for Basesystem 15
 before 4.23-3.9.1
4.23-3.9.1
mozilla-nss
SUSE:Linux Enterprise Module for Basesystem 15
 before 3.47.1-3.22.1
3.47.1-3.22.1
mozilla-nspr
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 4.23-3.9.1
4.23-3.9.1
mozilla-nss
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 3.47.1-3.22.1
3.47.1-3.22.1
mozilla-nss
SUSE:Linux Enterprise Module for Server Applications 15 SP1
 before 3.47.1-3.22.1
3.47.1-3.22.1
nss
Ubuntu:14.04:LTS
 before 2:3.28.4-0ubuntu0.14.04.5, plus listed versions
2:3.15.1-1ubuntu12:3.15.2-12:3.15.3-12:3.15.3.1-12:3.15.3.1-1.1
Show 22 moreShow less
2:3.15.3.1-1.1ubuntu12:3.15.4-1ubuntu32:3.15.4-1ubuntu42:3.15.4-1ubuntu52:3.15.4-1ubuntu62:3.15.4-1ubuntu72:3.15.4-1ubuntu7.12:3.17-0ubuntu0.14.04.12:3.17.1-0ubuntu0.14.04.12:3.17.1-0ubuntu0.14.04.22:3.17.4-0ubuntu0.14.04.12:3.19.2-0ubuntu0.14.04.12:3.19.2.1-0ubuntu0.14.04.12:3.19.2.1-0ubuntu0.14.04.22:3.21-0ubuntu0.14.04.12:3.21-0ubuntu0.14.04.22:3.23-0ubuntu0.14.04.12:3.26.2-0ubuntu0.14.04.32:3.28.4-0ubuntu0.14.04.12:3.28.4-0ubuntu0.14.04.22:3.28.4-0ubuntu0.14.04.32:3.28.4-0ubuntu0.14.04.4
2:3.28.4-0ubuntu0.14.04.5
nss
Ubuntu:16.04:LTS
 before 2:3.28.4-0ubuntu0.16.04.5, plus listed versions
2:3.19.2-1ubuntu12:3.19.2.1-0ubuntu12:3.21-1ubuntu22:3.21-1ubuntu32:3.21-1ubuntu4
Show 6 moreShow less
2:3.23-0ubuntu0.16.04.12:3.26.2-0ubuntu0.16.04.22:3.28.4-0ubuntu0.16.04.12:3.28.4-0ubuntu0.16.04.22:3.28.4-0ubuntu0.16.04.32:3.28.4-0ubuntu0.16.04.4
2:3.28.4-0ubuntu0.16.04.5
nss
Ubuntu:18.04:LTS
 before 2:3.35-2ubuntu2.2, plus listed versions
2:3.32-1ubuntu32:3.34-1ubuntu12:3.35-2ubuntu22:3.35-2ubuntu2.1
2:3.35-2ubuntu2.2
mozilla-nspr
openSUSE:Leap 15.1
 before 4.23-lp151.2.6.1
4.23-lp151.2.6.1
mozilla-nss
openSUSE:Leap 15.1
 before 3.47.1-lp151.2.9.1
3.47.1-lp151.2.9.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-18508 is a medium vulnerability (CVSS 6.5) in Mozilla Network Security Services, published December 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile. Fixed in nss 2:3.42.1-1.

References

Show 49 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open