CVE-2018-18508 In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.
MediumCVSS 6.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nss(Debian:12) | < 2:3.42.1-1 | 2:3.42.1-1 |
| debian/nss(Debian:13) | < 2:3.42.1-1 | 2:3.42.1-1 |
| debian/nss(Debian:14) | < 2:3.42.1-1 | 2:3.42.1-1 |
| mozilla network security services | < 3.36.7 | 3.36.7 |
| mozilla network security services | >= 3.41, < 3.41.1 | 3.41.1 |
| Siemens ruggedcom rox mx5000 firmware | < 2.14.0 | 2.14.0 |
| Siemens ruggedcom rox rx1400 firmware | < 2.14.0 | 2.14.0 |
| Siemens ruggedcom rox rx1500 firmware | < 2.14.0 | 2.14.0 |
| Siemens ruggedcom rox rx1501 firmware | < 2.14.0 | 2.14.0 |
| Siemens ruggedcom rox rx1510 firmware | < 2.14.0 | 2.14.0 |
| Siemens ruggedcom rox rx1511 firmware | < 2.14.0 | 2.14.0 |
| Siemens ruggedcom rox rx1512 firmware | < 2.14.0 | 2.14.0 |
| Siemens ruggedcom rox rx5000 firmware | < 2.14.0 | 2.14.0 |
| mozilla nss | < 3.41.1 | 3.41.1 |
| mozilla nss | < 3.36.7 | 3.36.7 |
References
- Debian Security Tracker CVE-2018-18508 vendor-advisory
- cert-portal.siemens.com third-party-advisory
- developer.mozilla.org release-notes vendor-advisory
- developer.mozilla.org release-notes vendor-advisory
- us-cert.cisa.gov third-party-advisory us-government-resource
- bugs.debian.org issue-tracking