CVE-2017-5462 A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to...
MediumCVSS 5.3
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 45.9.0esr-1 | 45.9.0esr-1 |
| debian/firefox-esr(Debian:13) | < 45.9.0esr-1 | 45.9.0esr-1 |
| debian/firefox-esr(Debian:14) | < 45.9.0esr-1 | 45.9.0esr-1 |
| debian/nss(Debian:12) | < 2:3.26.2-1.1 | 2:3.26.2-1.1 |
| debian/nss(Debian:13) | < 2:3.26.2-1.1 | 2:3.26.2-1.1 |
| debian/nss(Debian:14) | < 2:3.26.2-1.1 | 2:3.26.2-1.1 |
| debian linux | = 8.0 | No fix listed |
| mozilla Firefox | < 45.9.0 | 45.9.0 |
| mozilla Firefox | < 53.0 | 53.0 |
| mozilla Firefox | = 52.0 | No fix listed |
| mozilla network security services | < 3.28.4 | 3.28.4 |
| mozilla Thunderbird | < 52.1.0 | 52.1.0 |
| alpine/nss(Alpine:v3.3) | < 3.23-r1 | 3.23-r1 |
| alpine/nss(Alpine:v3.4) | < 3.23-r1 | 3.23-r1 |
| mozilla Thunderbird | < 52.1 | 52.1 |
| mozilla firefox esr | < 45.9 | 45.9 |
| mozilla firefox esr | < 52.1 | 52.1 |
| mozilla Firefox | < 53 | 53 |
References
- Debian Security Tracker CVE-2017-5462 vendor-advisory
- 97940 third-party-advisory vdb-entry
- 1038320 third-party-advisory vdb-entry
- bugzilla.mozilla.org issue-tracking
- GLSA-201705-04 third-party-advisory vendor-advisory
- DSA-3831 third-party-advisory vendor-advisory
- DSA-3872 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking