What’s Vulnerable › Vulnerabilities

CVE-2017-5462

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-11 · updated 2026-06-17
• Weakness: CWE-682

Description

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Affected products

• Debian Linux: 8.0
• Mozilla Firefox: before 45.9.0; before 53.0; 52.0 — fixed in 45.9.0, 53.0
• Mozilla Network Security Services: before 3.28.4 — fixed in 3.28.4
• Mozilla Thunderbird: before 52.1.0 — fixed in 52.1.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 45.9.0, 53.0; Mozilla Network Security Services 3.28.4; Mozilla Thunderbird 52.1.0. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/97940
• http://www.securitytracker.com/id/1038320
• https://bugzilla.mozilla.org/show_bug.cgi?id=1345089
• https://security.gentoo.org/glsa/201705-04
• https://www.debian.org/security/2017/dsa-3831
• https://www.debian.org/security/2017/dsa-3872
• https://www.mozilla.org/security/advisories/mfsa2017-10/
• https://www.mozilla.org/security/advisories/mfsa2017-11/
• https://www.mozilla.org/security/advisories/mfsa2017-12/
• https://www.mozilla.org/security/advisories/mfsa2017-13/
• http://www.securityfocus.com/bid/97940
• http://www.securitytracker.com/id/1038320

Get alerted when CVE-2017-5462 or the next vulnerability affects your stack