{"id":"CVE-2016-5285","aliases":["DEBIAN-CVE-2016-5285","EUVD-2016-6236","GHSA-5p92-qfvf-9h9q","RHSA-2016:2779","SUSE-SU-2016:3014-1","SUSE-SU-2016:3080-1","SUSE-SU-2016:3105-1","UBUNTU-CVE-2016-5285","USN-3163-1"],"status":"published","title":"Null pointer dereference vulnerability exists in K11_SignWithSymKey /...","description":"A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02279,"percentile":0.83244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2016-11-16T00:00:00Z","modified":"2026-09-22T07:01:37Z","fixes":[{"ecosystem":"Debian:12","package":"nss","fixed_in":["2:3.25-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nss","fixed_in":["2:3.25-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nss","fixed_in":["2:3.25-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nss","fixed_in":["2:3.26.2-0ubuntu0.14.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nss","fixed_in":["2:3.26.2-0ubuntu0.16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.25-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.25-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el6_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-sysinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-1.1.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"nss-pkcs11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.21.3-2.el7_3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.0esr-88.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-50.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-59.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-39.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.5.1esr-63.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3-30.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.26.2-0ubuntu0.14.04.3"}]}],"versions":["2:3.15.1-1ubuntu1","2:3.15.2-1","2:3.15.3-1","2:3.15.3.1-1","2:3.15.3.1-1.1","2:3.15.3.1-1.1ubuntu1","2:3.15.4-1ubuntu3","2:3.15.4-1ubuntu4","2:3.15.4-1ubuntu5","2:3.15.4-1ubuntu6","2:3.15.4-1ubuntu7","2:3.15.4-1ubuntu7.1","2:3.17-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.2","2:3.17.4-0ubuntu0.14.04.1","2:3.19.2-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.2","2:3.21-0ubuntu0.14.04.1","2:3.21-0ubuntu0.14.04.2","2:3.23-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.26.2-0ubuntu0.16.04.2"}]}],"versions":["2:3.19.2-1ubuntu1","2:3.19.2.1-0ubuntu1","2:3.21-1ubuntu2","2:3.21-1ubuntu3","2:3.21-1ubuntu4","2:3.23-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.26.2-0ubuntu0.14.04.3"}]}],"versions":["2:3.15.1-1ubuntu1","2:3.15.2-1","2:3.15.3-1","2:3.15.3.1-1","2:3.15.3.1-1.1","2:3.15.3.1-1.1ubuntu1","2:3.15.4-1ubuntu3","2:3.15.4-1ubuntu4","2:3.15.4-1ubuntu5","2:3.15.4-1ubuntu6","2:3.15.4-1ubuntu7","2:3.15.4-1ubuntu7.1","2:3.17-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.1","2:3.17.1-0ubuntu0.14.04.2","2:3.17.4-0ubuntu0.14.04.1","2:3.19.2-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.1","2:3.19.2.1-0ubuntu0.14.04.2","2:3.21-0ubuntu0.14.04.1","2:3.21-0ubuntu0.14.04.2","2:3.23-0ubuntu0.14.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.26.2-0ubuntu0.16.04.2"}]}],"versions":["2:3.19.2-1ubuntu1","2:3.19.2.1-0ubuntu1","2:3.21-1ubuntu2","2:3.21-1ubuntu3","2:3.21-1ubuntu4","2:3.23-0ubuntu0.16.04.1"],"bundled":3}],"products":[{"vendor":"avaya","product":"aura_application_enablement_services"},{"vendor":"avaya","product":"aura_application_server_5300"},{"vendor":"avaya","product":"aura_communication_manager"},{"vendor":"avaya","product":"aura_communication_manager_messagint"},{"vendor":"avaya","product":"aura_conferencing"},{"vendor":"avaya","product":"aura_experience_portal"},{"vendor":"avaya","product":"aura_messaging"},{"vendor":"avaya","product":"aura_session_manager"},{"vendor":"avaya","product":"aura_system_manager"},{"vendor":"avaya","product":"aura_system_platform_firmware"},{"vendor":"avaya","product":"aura_utility_services"},{"vendor":"avaya","product":"breeze_platform"},{"vendor":"avaya","product":"call_management_system"},{"vendor":"avaya","product":"cs1000e\\/cs1000m_signaling_server_firmware"},{"vendor":"avaya","product":"cs1000e_firmware"},{"vendor":"avaya","product":"cs1000m_firmware"},{"vendor":"avaya","product":"ip_office"},{"vendor":"avaya","product":"iq"},{"vendor":"avaya","product":"meeting_exchange"},{"vendor":"avaya","product":"message_networking"},{"vendor":"avaya","product":"one-x_client_enablement_services"},{"vendor":"avaya","product":"proactive_contact"},{"vendor":"avaya","product":"session_border_controller_for_enterprise_firmware"},{"vendor":"debian","product":"debian_linux"},{"vendor":"mozilla","product":"network security services"},{"vendor":"mozilla","product":"nss"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"suse","product":"linux_enterprise_server"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/94349","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201701-46","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2779.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3163-1","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://bto.bluecoat.com/security-advisory/sa137","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1306103","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5285","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5285"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-5285"},{"url":"https://downloads.avaya.com/css/P8/documents/101033728"},{"url":"https://packetstormsecurity.com/files/cve/CVE-2016-5285"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5285","tags":["advisory"]},{"url":"https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2016-5285"},{"url":"https://github.com/advisories/GHSA-5p92-qfvf-9h9q"},{"url":"https://access.redhat.com/errata/RHSA-2016:2779","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1347908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1383883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1391818","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2779.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2834","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2834","tags":["advisory"]},{"url":"https://www.mozilla.org/security/announce/2016/mfsa2016-61.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5285","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8635","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163014-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009026","tags":["report"]},{"url":"https://bugzilla.suse.com/1010395","tags":["report"]},{"url":"https://bugzilla.suse.com/1010401","tags":["report"]},{"url":"https://bugzilla.suse.com/1010402","tags":["report"]},{"url":"https://bugzilla.suse.com/1010404","tags":["report"]},{"url":"https://bugzilla.suse.com/1010410","tags":["report"]},{"url":"https://bugzilla.suse.com/1010422","tags":["report"]},{"url":"https://bugzilla.suse.com/1010427","tags":["report"]},{"url":"https://bugzilla.suse.com/1010517","tags":["report"]},{"url":"https://bugzilla.suse.com/992549","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9074","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000751","tags":["report"]},{"url":"https://bugzilla.suse.com/1012964","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9079","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163105-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-5285","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3163-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-8635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9074","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-5285","description":"A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.","status":"published","published":"2019-11-15T15:44:05Z","modified":"2024-08-06T00:53:48.923Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6236","description":"A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.","status":"published","published":"2019-11-15T15:44:05Z","modified":"2024-08-06T00:53:48Z","updated_at":"2026-11-03T02:22:42.996947Z"}],"ghsa":[{"id":"GHSA-5p92-qfvf-9h9q","title":"Null pointer dereference vulnerability exists in K11_SignWithSymKey /...","description":"Null pointer dereference vulnerability exists in K11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime in NSS before 3.26, which causes the TLS/SSL server using NSS to crash.","status":"published","published":"2022-05-24T17:01:22Z","modified":"2023-01-28T05:08:18Z","updated_at":"2026-11-02T14:44:36.910779Z"}],"nvd":[{"id":"CVE-2016-5285","description":"A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.","status":"published","published":"2019-11-15T16:15:10.11Z","modified":"2026-06-17T00:49:07.227Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"CVE-2016-5285","description":"A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.","status":"published","published":"2019-11-15T16:15:10.11Z","modified":"2026-03-15T22:09:24.570596Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-5285","description":"A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.","status":"published","published":"2019-11-15T16:15:10.11Z","modified":"2026-09-22T07:01:37.749637822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"RHSA-2016:2779","title":"Red Hat Security Advisory: nss and nss-util security update","status":"published","published":"2024-09-15T23:46:34Z","modified":"2026-07-01T10:01:26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-5285","description":"A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.","status":"published","published":"2016-11-16T00:00:00Z","modified":"2026-04-22T10:51:12.910052Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"SUSE-SU-2016:3014-1","title":"Security update for MozillaFirefox, mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss fixes security issues and bugs.\n\nThe following vulnerabilities were fixed in Firefox ESR 45.5 (bsc#1009026):\n\n- CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401)\n- CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404)\n- CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010395)\n- CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402)\n- CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427)\n- CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410)\n\nThe following vulnerabilities were fixed in mozilla-nss 3.21.3:\n\n- CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422)\n- CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash (bsc#1010517)  \n\nThe following bugs were fixed:\n\n- Firefox would fail to go into fullscreen mode with some window managers (bsc#992549)\n\nThe Mozilla Firefox changelog was amended to document patched dropped in a previous update.\n","status":"published","published":"2016-12-05T17:04:31Z","modified":"2026-02-04T03:58:31.996817Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3080-1","title":"Security update for MozillaFirefox, mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss fixes security issues and bugs.\n\nThe following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026 bsc#1012964):\n\n- CVE-2016-9079: Use-after-free in SVG Animation (MFSA 2016-92  bsc#1012964)\n- CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401)\n- CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404)\n- CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010395)\n- CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402)\n- CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427)\n- CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410)\n\nThe following vulnerabilities were fixed in mozilla-nss 3.21.3:\n\n- CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422)\n- CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash (bsc#1010517)\n    \nThe following bugs were fixed:\n\n- Firefox would fail to go into fullscreen mode with some window managers (bsc#992549)\n- font warning messages would flood console, now using fontconfig configuration from\n  firefox-fontconfig instead of the system one (bsc#1000751)\n","status":"published","published":"2016-12-10T18:21:00Z","modified":"2026-02-04T03:51:44.827064Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3105-1","title":"Security update for MozillaFirefox, mozilla-nss","description":"This update for MozillaFirefox, mozilla-nss fixes security issues and bugs.\n\nThe following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026):\n\n- CVE-2016-9079: Use-after-free in SVG Animation (bsc#1012964 MFSA 2016-92)\n- CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401)\n- CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404)\n- CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010395)\n- CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402)\n- CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427)\n- CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410)\n\nThe following vulnerabilities were fixed in mozilla-nss 3.21.3:\n\n- CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422)\n- CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash (bsc#1010517)\n\nThe following bugs were fixed:\n\n- Firefox would fail to go into fullscreen mode with some window managers (bsc#992549)\n- font warning messages would flood console, now using fontconfig configuration from\n  firefox-fontconfig instead of the system one (bsc#1000751)\n","status":"published","published":"2016-12-13T08:18:24Z","modified":"2026-02-04T03:38:13.022928Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3163-1","title":"nss vulnerabilities","description":"It was discovered that NSS incorrectly handled certain invalid\nDiffie-Hellman keys. A remote attacker could possibly use this flaw to\ncause NSS to crash, resulting in a denial of service. This issue only\napplied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2016-5285)\n\nHubert Kario discovered that NSS incorrectly handled Diffie Hellman client\nkey exchanges. A remote attacker could possibly use this flaw to perform a\nsmall subgroup confinement attack and recover private keys. This issue only\napplied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2016-8635)\n\nFranziskus Kiefer discovered that NSS incorrectly mitigated certain timing\nside-channel attacks. A remote attacker could possibly use this flaw to\nrecover private keys. (CVE-2016-9074)\n\nThis update refreshes the NSS package to version 3.26.2 which includes\nthe latest CA certificate bundle.\n","status":"published","published":"2017-01-04T16:32:54Z","modified":"2026-04-22T09:30:52.92325Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}