CVE-2017-5462

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-682

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 52.1
Mozilla	Firefox ESR	>= unspecified, < 45.9; >= unspecified, < 52.1
Mozilla	Firefox	>= unspecified, < 53

References

http://www.securityfocus.com/bid/97940Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038320Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1345089Issue Tracking
https://security.gentoo.org/glsa/201705-04Third Party Advisory
https://www.debian.org/security/2017/dsa-3831Third Party Advisory
https://www.debian.org/security/2017/dsa-3872Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-11/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-13/Vendor Advisory
http://www.securityfocus.com/bid/97940Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038320Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1345089Issue Tracking
https://security.gentoo.org/glsa/201705-04Third Party Advisory
https://www.debian.org/security/2017/dsa-3831Third Party Advisory
https://www.debian.org/security/2017/dsa-3872Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-11/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-13/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-54635.3Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the con CVE-2017-54649.8During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading CVE-2017-54659.1An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible me CVE-2017-54666.1If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will ru CVE-2017-54677.5A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulner CVE-2017-54689.1An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools. This can result in a non-exploitab CVE-2017-54699.8Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird < 52.1 CVE-2017-54709.8Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume CVE-2017-54719.8Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2017-54729.8A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node i CVE-2017-54738.8Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary user CVE-2017-54746.1Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and