CVE-2017-5462

MEDIUM
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

References

http://www.securityfocus.com/bid/97940

http://www.securitytracker.com/id/1038320

https://bugzilla.mozilla.org/show_bug.cgi?id=1345089

https://security.gentoo.org/glsa/201705-04

https://www.debian.org/security/2017/dsa-3831

https://www.debian.org/security/2017/dsa-3872

https://www.mozilla.org/security/advisories/mfsa2017-10/

https://www.mozilla.org/security/advisories/mfsa2017-11/

https://www.mozilla.org/security/advisories/mfsa2017-12/

https://www.mozilla.org/security/advisories/mfsa2017-13/

Details

Source: MITRE

Published: 2018-06-11

Updated: 2019-10-03

Type: CWE-682

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Impact Score: 1.4

Exploitability Score: 3.9

Severity: MEDIUM

Tenable Plugins

View all (26 total)

IDNameProductFamilySeverity
106884GLSA-201802-03 : Mozilla Firefox: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
102694SUSE SLES11 Security Update : MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss (SUSE-SU-2017:2235-1)NessusSuSE Local Security Checks
critical
101055SUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2017:1669-1)NessusSuSE Local Security Checks
critical
100580Debian DSA-3872-1 : nss - security updateNessusDebian Local Security Checks
critical
100302Debian DLA-946-1 : nss security updateNessusDebian Local Security Checks
critical
100249Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : thunderbird vulnerabilities (USN-3278-1)NessusUbuntu Local Security Checks
critical
100153Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : firefox regression (USN-3260-2)NessusUbuntu Local Security Checks
critical
100151SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss, mozilla-nspr, java-1_8_0-openjdk (SUSE-SU-2017:1248-1)NessusSuSE Local Security Checks
critical
100020openSUSE Security Update : MozillaThunderbird (openSUSE-2017-545)NessusSuSE Local Security Checks
critical
100018GLSA-201705-04 : Mozilla Network Security Service (NSS): Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
99992SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss, mozilla-nspr (SUSE-SU-2017:1175-1)NessusSuSE Local Security Checks
critical
99968Mozilla Thunderbird < 52.1 Multiple VulnerabilitiesNessusWindows
critical
99967Mozilla Thunderbird < 52.1 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
99632Mozilla Firefox < 53 Multiple VulnerabilitiesNessusWindows
critical
99631Mozilla Firefox ESR 52.x < 52.1 Multiple VulnerabilitiesNessusWindows
critical
99630Mozilla Firefox ESR 45.x < 45.9 Multiple VulnerabilitiesNessusWindows
critical
99629Mozilla Firefox < 53 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
99628Mozilla Firefox ESR < 52.1 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
99627Mozilla Firefox ESR 45.x < 45.9 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
99626Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : firefox vulnerabilities (USN-3260-1)NessusUbuntu Local Security Checks
critical
99600Debian DLA-906-1 : firefox-esr security updateNessusDebian Local Security Checks
critical
99553FreeBSD : NSS -- multiple vulnerabilities (4cb165f0-6e48-423e-8147-92255d35c0f7)NessusFreeBSD Local Security Checks
critical
700066Mozilla Firefox ESR < 52.1 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
700065Mozilla Firefox < 53 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
99496FreeBSD : mozilla -- multiple vulnerabilities (5e0a038a-ca30-416d-a2f5-38cbf5e7df33)NessusFreeBSD Local Security Checks
critical
99485Debian DSA-3831-1 : firefox-esr - security updateNessusDebian Local Security Checks
critical