CVE-2017-7502

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-30 · updated 2026-06-17
Weakness: CWE-476

Description

Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.

Affected products

Mozilla Network Security Services: 3.24.0, 3.25.0, 3.25.1, 3.26.0, 3.26.2, 3.27.0 (+12)

References

http://www.debian.org/security/2017/dsa-3872
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.securityfocus.com/bid/98744
http://www.securitytracker.com/id/1038579
https://access.redhat.com/errata/RHSA-2017:1364
https://access.redhat.com/errata/RHSA-2017:1365
https://access.redhat.com/errata/RHSA-2017:1567
https://access.redhat.com/errata/RHSA-2017:1712
https://hg.mozilla.org/projects/nss/rev/55ea60effd0d
http://www.debian.org/security/2017/dsa-3872
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.securityfocus.com/bid/98744

Get alerted when CVE-2017-7502 or the next vulnerability affects your stack