cbcvebase.
CVE-2017-5462
published 2018-06-11

CVE-2017-5462: A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS…

PriorityP426medium5.3CVSS 3.0
AVNACLPRNUINSUCNILAN
EPSS
2.64%
83.9th percentile
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Affected

23 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debianfirefox< firefox 52.0.1-1 (sid)firefox 52.0.1-1 (sid)
debianfirefox-esr< firefox 52.0.1-1 (sid)firefox 52.0.1-1 (sid)
debiannss< firefox 52.0.1-1 (sid)firefox 52.0.1-1 (sid)
mozillafirefox< 45.9.045.9.0
mozillafirefox< 53.053.0
mozillafirefox
mozillafirefox>= 0 < 53.0.2+build1-0ubuntu0.14.04.253.0.2+build1-0ubuntu0.14.04.2
mozillafirefox>= 0 < 53.0+build6-0ubuntu0.14.04.153.0+build6-0ubuntu0.14.04.1
mozillafirefox>= 0 < 53.0.2+build1-0ubuntu0.16.04.253.0.2+build1-0ubuntu0.16.04.2
mozillafirefox>= 0 < 53.0+build6-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.1
mozillafirefox>= unspecified < 5353
mozillafirefox_esr>= unspecified < 45.945.9
mozillafirefox_esr>= unspecified < 52.152.1
mozillanetwork_security_services< 3.28.43.28.4
mozillanss>= 0 < 2:3.26.2-1.12:3.26.2-1.1
mozillanss>= 0 < 2:3.26.2-1.12:3.26.2-1.1
mozillanss>= 0 < 2:3.26.2-1.12:3.26.2-1.1
mozillanss>= 0 < 2:3.26.2-1.12:3.26.2-1.1
mozillathunderbird< 52.1.052.1.0
mozillathunderbird>= 0 < 1:52.1.1+build1-0ubuntu0.14.04.11:52.1.1+build1-0ubuntu0.14.04.1
mozillathunderbird>= 0 < 1:52.1.1+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.1
mozillathunderbird>= unspecified < 52.152.1

CVSS provenance

nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.