What’s Vulnerable › Vulnerabilities

CVE-2016-5285

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-15 · updated 2026-06-17
• Weakness: CWE-476

Description

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

Affected products

• Avaya Aura Application Enablement Services: from 6.1 through 6.3.3; 7.0
• Avaya Aura Application Server 5300: 3.0, 3.0-sp1, 3.0-sp10, 3.0-sp10.1, 3.0-sp11, 3.0-sp11.1 (+8)
• Avaya Aura Communication Manager: from 6.0 through 6.3.117.0; 7.0, 7.0-sp, 7.0-sp3
• Avaya Aura Communication Manager Messagint: 7.0, 7.0-sp1
• Avaya Equinox Conferencing Management (iView): 7.0, 7.2, 8.0, 8.0-sp2, 8.0-sp4, 8.0-sp5 (+3)
• Avaya Experience Portal Manager: from 6.0 through 7.1
• Avaya Aura Messaging: 6.3, 6.3.3, 6.3.3-sp4, 6.3.3-sp5, 6.3.3-sp6
• Avaya Aura Session Manager: from 6.3 through 6.3.18; 7.0, 7.0-sp1, 7.0-sp2, 7.0.1, 7.0.1-sp1, 7.0.1-sp2
• Avaya Aura System Manager: from 6.3 through 6.3.18; from 7.0 through 7.0.1.3
• Avaya Aura System Platform Firmware: from 6.3 through 6.4.0
• Avaya Aura Utility Services: from 6.3 through 6.3.14; from 7.0 through 7.0.1.2
• Avaya Breeze Platform: from 3.0 through 3.2
• Avaya Call Management System: from 18.0.0.1 through 18.0.0.2; 17.0, 17.0-r3, 17.0-r4, 17.0-r5, 17.0-r6
• Avaya Cs1000E/Cs1000M Signaling Server Firmware: from 7.0 through 7.6
• Avaya Cs1000E Firmware: from 7.0 through 7.6
• Avaya Cs1000M Firmware: from 7.0 through 7.6
• Avaya IP Office: 8.1, 9.1, 9.1-sp1, 9.1-sp10, 9.1-sp11, 9.1-sp12 (+15)
• Avaya Iq: 5.2.x
• Avaya Meeting Exchange: 6.2, 6.2-sp3
• Avaya Message Networking: from 5.2 through 6.3
• Avaya One-X Client Enablement Services: 6.2, 6.2-sp1, 6.2-sp2, 6.2-sp5
• Avaya Proactive Contact: from 5.0 through 5.1.2
• Avaya Session Border Controller For Enterprise Firmware: from 6.2 through 6.3; from 7.0 through 7.1
• Debian Linux: 8.0, 9.0, 10.0
• Mozilla NSS: before 3.26 — fixed in 3.26
• Red Hat Enterprise Linux: 5.0, 6.0, 7.0
• SUSE Linux Enterprise Server: 11-sp2

How to fix

Upgrade to a fixed version: Mozilla NSS 3.26. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html
• http://rhn.redhat.com/errata/RHSA-2016-2779.html
• http://www.securityfocus.com/bid/94349
• http://www.ubuntu.com/usn/USN-3163-1
• https://bto.bluecoat.com/security-advisory/sa137
• https://bugzilla.mozilla.org/show_bug.cgi?id=1306103
• https://security.gentoo.org/glsa/201701-46
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html

Get alerted when CVE-2016-5285 or the next vulnerability affects your stack