CVE-2017-7502

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
NSS project	nss	since 3.24.0

References

Timeline

Published: May 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75039.8It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker cou CVE-2017-75049.8HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Appli CVE-2017-75058.8Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assig CVE-2017-75068.8spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attac CVE-2017-75077.5GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid cont CVE-2017-75087.5OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.CVE-2017-75096.5An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq CVE-2017-75108.8In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface.CVE-2017-75115.5poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents.CVE-2017-75129.8Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. CVE-2017-75135.4It was found that Satellite 5 configured with SSL/TLS for the PostgreSQL backend failed to correctly validate X.509 server certificate host CVE-2017-75145.4A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user ab